---
id: "CVE-2026-117499"
kind: "vulnerability"
aliases: ["CVE-2026-117499"]
title: "@fastify/session: in-flight request can revive a logged-out session"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fastify", "node", "package", "self-hosted", "session-auth"]
not_affected_if: ["fixed-version", "no-session-plugin"]
published_at: "2026-10-27T12:17:07+00:00"
first_seen_at: "2026-10-27T12:31:37+00:00"
updated_at: "2026-10-27T12:32:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117499", "first_seen_at": "2026-10-27T12:31:37+00:00"}]
---

# @fastify/session: in-flight request can revive a logged-out session

Fastify's session plugin, before 11.1.6, can let a request that started before a logout save its copy of the session after the logout destroyed it, recreating the session. An attacker who already holds a victim's valid signed session cookie can replay it across a logout to restore access after revocation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npm ls @fastify/session` in the project to find the installed version
- Check the lockfile for `@fastify/session` entries below `11.1.6`

## Fix

- Upgrade `@fastify/session` to `11.1.6` or later
- Custom session stores must implement the new conditional write

## Timeline

- 2026-10-27T12:31:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117499

## From the sources

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_