CVE WATCH / VULNERABILITY DETAIL
CVE-2026-117549
MEDIUMCVSS 4.2NVD feed
Published 2 November 2026 · tracked since 2 November 2026
Description
@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still pas
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog