PatchSiren

@fastify/secure-session CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM @fastify/secure-session CVE published 2026-11-02

CVE-2026-117549

CVE-2026-117549 @fastify/secure-session Session Cookie Signature Validation Bypass. The @fastify/secure-session plugin for Fastify stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when configured with the signed cookie option, the plugin fails to properly validate the signature of the cookie. If the signature check fails, the plugin still passes the original cookie value to the se [truncated]