Description
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write.
Published: 2026-10-27
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: Session revocation bypass
Action: Update
AI Analysis

Impact

A race condition in @fastify/session allows a session to be restored after a logout, enabling an attacker holding a valid signed session cookie to replay the session once it was meant to be invalidated. This bypasses session revocation and permits continued authorized access without having to steal or forge cookies.

Affected Systems

The flaw affects @fastify/session for Fastify in all releases prior to 11.1.6 when the default rolling session behavior is enabled. The issue resides in the session handling logic that does not check for a session’s generation marker during restoration.

Risk and Exploitability

The problem carries a CVSS score of 3.7, classifying it as low severity. EPSS information is not available, and it is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Successful exploitation requires an attacker to already possess a valid signed session cookie and to coordinate a delayed request with a logout, making the attack vector remote via HTTP.

Generated by OpenCVE AI on October 27, 2026 at 13:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade @fastify/session to version 11.1.6 or later, which adds a per‑session generation marker and a conditional store write to eliminate the race condition that arises from concurrent write/read operations (CWE‑362).
  • If a newer plugin version cannot be adopted immediately, modify any custom session store implementation to support the conditional write logic introduced in the fix, ensuring restores that occur after a logout or regeneration are rejected (CWE‑613).
  • Disable automatic session rolling or add stricter session termination controls to shorten the window in which concurrent restoration could occur, reducing the chance of a race condition (CWE‑362).

Generated by OpenCVE AI on October 27, 2026 at 13:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description @fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write.
Title @fastify/session vulnerable to session revocation bypass via a logout race condition
Weaknesses CWE-362
CWE-613
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: openjs

Published:

Updated: 2026-10-27T11:19:22.090Z

Reserved: 2026-10-27T08:37:38.311Z

Link: CVE-2026-117499

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-27T12:17:07.370

Modified: 2026-10-27T15:03:41.023

Link: CVE-2026-117499

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T13:30:04Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-613

    Insufficient Session Expiration