Skip to content
OpenAdvisories

Vendor

@fastify/session

1 known vulnerabilities.

Products

@fastify/session 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-117499

    @fastify/session vulnerable to session revocation bypass via a logout race condition

    @fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call,…

    @fastify/session @fastify/session