CVE-2026-117549

Name of the Vulnerable Software and Affected Versions @fastify/secure-session versions 7.5.0 through 8.4.1

Description When configured with the signed cookie option, the plugin fails to stop processing when a signature check reports an invalid value. Instead, it passes the original cookie value to the session decoder, allowing a session with an invalid signature to be decrypted. This occurs if an application uses a cookie signing secret separate from the session encryption key and rotates only the signing secret. An attacker possessing an unexpired encrypted session cookie can strip the obsolete signature to continue using the session. The attacker cannot forge session data, extend expiry, or bypass rotation of the encryption key.

Recommendations Update to version 8.4.2 or later. Rotate the session encryption key instead of relying solely on the rotation of the cookie signing secret.