Skip to content
OpenAdvisories

Vendor

@fastify/secure-session

1 known vulnerabilities.

Products

@fastify/secure-session 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.2
    CVE-2026-117549

    @fastify/secure-session vulnerable to signature verification bypass via cookie signature removal

    @fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature chec…

    @fastify/secure-session @fastify/secure-session