{"id":"CVE-2026-117499","kind":"vulnerability","aliases":["CVE-2026-117499"],"related":[],"title":"@fastify/session: in-flight request can revive a logged-out session","description":"@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write.","summary":"Fastify's session plugin, before 11.1.6, can let a request that started before a logout save its copy of the session after the logout destroyed it, recreating the session. An attacker who already holds a victim's valid signed session cookie can replay it across a logout to restore access after revocation.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fastify","node","package","self-hosted","session-auth"],"not_affected_if":["fixed-version","no-session-plugin"],"how_to_check":"- Run `npm ls @fastify/session` in the project to find the installed version\n- Check the lockfile for `@fastify/session` entries below `11.1.6`","fix":"- Upgrade `@fastify/session` to `11.1.6` or later\n- Custom session stores must implement the new conditional write","status":"open","published_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","triaged_at":"2026-10-27T12:32:18+00:00","updated_at":"2026-10-27T12:32:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T12:32:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `@fastify/session` to `11.1.6` or later\n- Custom session stores must implement the new conditional write","reach":"internet","title":"@fastify/session: in-flight request can revive a logged-out session","impact":"medium","summary":"Fastify's session plugin, before 11.1.6, can let a request that started before a logout save its copy of the session after the logout destroyed it, recreating the session. An attacker who already holds a victim's valid signed session cookie can replay it across a logout to restore access after revocation.","category":"package","nicknames":[],"who_cares":["fastify","node","self-hosted","session-auth"],"confidence":0.8,"needs_auth":"yes","worst_case":"revoked session restored, attacker regains victim's authenticated access","analyst_note":"","how_to_check":"- Run `npm ls @fastify/session` in the project to find the installed version\n- Check the lockfile for `@fastify/session` entries below `11.1.6`","needs_analyst":false,"not_affected_if":["fixed-version","no-session-plugin"],"who_is_affected":"Applications on Fastify that use @fastify/session with the default rolling session behavior and rely on logout to revoke sessions. The attacker must already hold a valid signed session cookie for the victim, and must keep a request in flight across the logout. Applications not using @fastify/session, or on 11.1.6 or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000605,"input_tokens":3466,"output_tokens":516,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-117499':15A,18A '-2026':14A,17A '11.1.6':33B,91C,179C,213C 'access':77B 'across':72B,148C 'add':181C 'alreadi':60B,133C 'anoth':113C 'attack':58B,131C 'auth':27B 'authent':128C 'behavior':97C 'call':120C 'cannot':201C 'complet':116C 'condit':189C,228C 'cooki':68B,141C,154C,168C 'copi':45B,111C 'could':107C 'current':206C 'custom':221C 'cve':13A,16A 'data':129C 'default':94C 'destroy':52B,119C,123C 'entri':207C 'fastifi':19B,28B,86C 'fastify/session':1A,80C,178C 'fix':176C 'flight':4A,147C 'forgeri':172C 'generat':185C 'hold':61B,134C 'host':24B 'identifi':125C 'implement':225C 'in-flight':2A 'issu':174C 'keep':143C 'later':215C 'let':35B 'log':10A 'logged-out':9A 'logout':42B,51B,74B,106C,150C,198C 'marker':186C 'meant':162C 'must':224C 'new':227C 'node':20B 'overwrit':204C 'packag':21B 'per':183C 'plugin':31B,84C 'recreat':54B,121C,202C 'regener':200C 'releas':89C 'replay':70B,152C 'request':5A,37B,99C,114C,145C 'restor':76B,101C,156C,195C 'reviv':7A 'revoc':79B 'revok':165C 'roll':95C 'save':43B,108C 'self':23B 'self-host':22B 'session':12A,26B,30B,48B,56B,67B,83C,96C,103C,118C,124C,140C,158C,184C,194C,222C 'session-auth':25B 'sign':66B,139C 'signatur':171C 'start':39B 'store':190C,223C 'theft':169C 'upgrad':211C 'user':209C 'valid':65B,138C 'victim':63B,136C 'without':166C 'workaround':219C 'write':191C,229C","nicknames":[],"mitigations":[],"who_affected":"Applications on Fastify that use @fastify/session with the default rolling session behavior and rely on logout to revoke sessions. The attacker must already hold a valid signed session cookie for the victim, and must keep a request in flight across the logout. Applications not using @fastify/session, or on 11.1.6 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117499","severity":null,"published_at":"2026-10-27T12:17:07+00:00","modified_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","fetched_at":"2026-10-27T12:31:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}