CVE-2026-117549
Received Received - Intake

Session Decoding Bypass in @fastify/secure-session

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: openjs

Description
@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still passes the original cookie value to the session decoder, so a session whose signature did not validate is decrypted anyway. The practical effect appears when an application supplies the cookie signing secret independently of the session encryption key and rotates only the signing secret to retire existing sessions while keeping the encryption key active, because a holder of an old session cookie can strip the now obsolete signature and keep using the session. The attacker must already possess an unexpired encrypted session cookie and needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key. The issue is fixed in @fastify/secure-session 8.4.2, which no longer decodes the session when the signed cookie option is set and the signature check fails, and users should upgrade to 8.4.2 or later. As a workaround, rotate the session encryption key rather than relying on rotation of the cookie signing secret alone.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-117549

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
@fastify/secure-session @fastify/secure-session 7.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects @fastify/secure-session versions 7.5.0 through 8.4.1. When configured with a signed cookie option, the plugin fails to reject sessions with invalid signatures. Instead, it still decrypts the session, allowing attackers with an old session cookie to bypass signature checks and continue using the session even after the signing secret is rotated.

Detection Guidance

To detect this vulnerability, inspect cookies in HTTP requests for the @fastify/secure-session plugin. Check if sessions are still valid after signing secret rotation. Look for unsigned cookies being processed despite signature failures.

Impact Analysis

If you use @fastify/secure-session with signed cookies, an attacker who obtains an old session cookie can strip the signature and continue using the session even after you rotate the signing secret. This allows unauthorized access to user sessions without needing the encryption key or forging new data.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized session access. If an attacker exploits this flaw, they may gain access to sensitive user data stored in sessions without proper authentication, which violates data protection principles under GDPR (e.g., integrity and confidentiality) and HIPAA (e.g., safeguarding protected health information).

Mitigation Strategies
  • Upgrade @fastify/secure-session to version 8.4.2 or later to fix the issue.
  • Rotate the session encryption key instead of relying solely on signing secret rotation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117549. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...