@fastify/secure-session vulnerabilities

Products

• @fastify/secure-session 1

Latest @fastify/secure-session CVEs

Newest publication first

1. CVE-2026-117549 @fastify/secure-session vulnerable to signature verification bypass via cookie signature removal

   Published 2026-11-02

   Medium·CVSS 4.2

   @fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.