Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117549— @fastify/secure-session vulnerable to signature verification bypass via cookie signature removal

Quick assessment

Affected
@fastify/secure-session @fastify/secure-session
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

@fastify/secure-session 是 Fastify 的一个会话插件，它将加密后的会话数据存储在 Cookie 中。在 7.5.0 至 8.4.1 版本中，当插件配置为使用“签名 Cookie"选项时，会调用 Cookie 的签名验证（unsign）流程；然而，即使签名检查报告值为无效，插件仍会将原始 Cookie 值传递给会话解密器，导致签名未通过验证的会话依然被解密。 该问题的实际影响在于：当应用程序独立提供 Cookie 签名密钥与会话加密密钥，并仅轮换签名密钥以废弃现有会话（同时保持加密密钥有

CVSS 4.2 · Medium

Possible ATT&CK Techniques 2 AI

T1003.003 · NTDS T1538.003
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117549

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/secure-session vulnerable to signature verification bypass via cookie signature removal
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still passes the original cookie value to the session decoder, so a session whose signature did not validate is decrypted anyway. The practical effect appears when an application supplies the cookie signing secret independently of the session encryption key and rotates only the signing secret to retire existing sessions while keeping the encryption key active, because a holder of an old session cookie can strip the now obsolete signature and keep using the session. The attacker must already possess an unexpired encrypted session cookie and needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key. The issue is fixed in @fastify/secure-session 8.4.2, which no longer decodes the session when the signed cookie option is set and the signature check fails, and users should upgrade to 8.4.2 or later. As a workaround, rotate the session encryption key rather than relying on rotation of the cookie signing secret alone.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/secure-session @fastify/secure-session 7.5.0 ~ 8.4.2 -

II. Public POCs for CVE-2026-117549

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117549

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-117549 (1)

IV. Related Vulnerabilities

Same weakness: CWE-347