CVE-2026-117549 @fastify/secure-session CVE debrief

Who should care

Fastify application developers and administrators using @fastify/secure-session 7.5.0 through 8.4.1 with the signed cookie option should assess their exposure and take necessary actions to secure their applications.

Why it matters

CVE-2026-117549 is a medium-severity vulnerability in @fastify/secure-session that allows an attacker to bypass signature validation for encrypted session cookies. Developers and administrators of Fastify applications using affected versions should prioritize upgrading to 8.4.2 or later and review their session management configurations.

• An attacker can continue using an unexpired encrypted session cookie even after the cookie signing secret has been rotated
• Session encryption key rotation may be required to fully mitigate the vulnerability
• Fastify application configurations need to be reviewed and updated to ensure secure session management

Technical summary

The @fastify/secure-session plugin for Fastify stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when configured with the signed cookie option, the plugin fails to properly validate the signature of the cookie. If the signature check fails, the plugin still passes the original cookie value to the session decoder, allowing an attacker with an unexpired encrypted session cookie to continue using the session.

Defensive priority

Medium priority for Fastify applications using @fastify/secure-session 7.5.0 through 8.4.1 with signed cookie option

Recommended defensive actions

• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Rotate the session encryption key if upgrading is not feasible.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in @fastify/secure-session. The issue allows an attacker with an unexpired encrypted session cookie to continue using the session even after the cookie signing secret has been rotated, as long as the encryption key remains active.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.