Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117499— @fastify/session vulnerable to session revocation bypass via a logout race condition

Quick assessment

Affected
@fastify/session @fastify/session
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是 Fastify 框架的会话插件。在 11.1.6 版本之前的所有版本中，若使用默认的会话滚动（rolling session）行为，当某个请求在登出操作之前恢复了会话，而另一个请求随后完成了会话销毁操作时，该请求仍可能保存其自身的会话副本，从而以已销毁的会话标识符重新创建包含已认证数据的会话。攻击者若已持有受害者的有效签名会话 Cookie，并能在登出过程中保持一个请求处于“飞行中”（in-flight）状态，即可重放该 Cookie，在会话本应被撤销后再次恢复其会话，且无需进行 Cookie 窃取或签名伪造。

CVSS 3.7 · Low

Affected Version Matrix 2

VendorProduct Version RangeStatus
@fastify/session @fastify/session < 11.1.6 affected
11.1.6 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117499

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/session vulnerable to session revocation bypass via a logout race condition
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/session @fastify/session 0 ~ 11.1.6 -

II. Public POCs for CVE-2026-117499

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117499

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-117499 (1)

IV. Related Vulnerabilities

Same weakness: CWE-362