Fastify Secure Session
Monthly
Signature verification bypass in @fastify/secure-session 7.5.0 through 8.4.1 allows a holder of an already-issued encrypted session cookie to keep using that session after the cookie signature has been invalidated. When cookie.signed is enabled the plugin calls the cookie unsign routine but, if the signature check reports invalid, it still hands the original cookie value to the session decoder, so the session is decrypted anyway; the practical effect appears only when an application supplies the @fastify/cookie signing secret independently of the session encryption key and retires sessions by rotating just the signing secret. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects that the attacker must already possess an unexpired encrypted session cookie, needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied fix is 8.4.2.
Signature verification bypass in @fastify/secure-session 7.5.0 through 8.4.1 allows a holder of an already-issued encrypted session cookie to keep using that session after the cookie signature has been invalidated. When cookie.signed is enabled the plugin calls the cookie unsign routine but, if the signature check reports invalid, it still hands the original cookie value to the session decoder, so the session is decrypted anyway; the practical effect appears only when an application supplies the @fastify/cookie signing secret independently of the session encryption key and retires sessions by rotating just the signing secret. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects that the attacker must already possess an unexpired encrypted session cookie, needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied fix is 8.4.2.