CVE-2026-117499

Name of the Vulnerable Software and Affected Versions @fastify/session versions prior to 11.1.6

Description With the default rolling session behavior, a request that restores a session before a logout can save its own copy after another request has completed the session destroy call. This allows the recreation of a destroyed session identifier along with its authenticated data. An attacker possessing a victim's valid signed session cookie can keep a request in flight during logout and replay that cookie to restore the session after it was intended to be revoked, without requiring cookie theft or signature forgery.

Recommendations Update to version 11.1.6 or later. Custom session stores must implement the new conditional write.