Skip to content

Product

fastify @fastify/session vulnerabilities

1 published CVE affecting fastify @fastify/session, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest fastify @fastify/session CVEs

Newest publication first

  1. CVE-2024-35220 @fastify/session reuses destroyed session cookie

    Published
    HighCVSS 7.4

    @fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired session...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.