Fastify Session
Monthly
Session revocation bypass in @fastify/session before 11.1.6 lets an authenticated remote attacker who already holds a victim's valid signed session cookie keep that session alive after logout by winning a narrow timing race: a request that restored the session before the logout can still write its own copy of the store entry after another request's Session#destroy() has completed, recreating the destroyed identifier with its authenticated data. The default rolling: true behavior is required, no cookie theft or signature forgery is involved, and the attacker gains nothing beyond a session they could already use - the flaw extends or resurrects an existing session rather than creating initial access (CVSS 3.1 base 3.7, AV:N/AC:H/PR:L/UI:R, C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has released a fix in 11.1.6 that adds a per-session generation marker plus a conditional store write.
Session revocation bypass in @fastify/session before 11.1.6 lets an authenticated remote attacker who already holds a victim's valid signed session cookie keep that session alive after logout by winning a narrow timing race: a request that restored the session before the logout can still write its own copy of the store entry after another request's Session#destroy() has completed, recreating the destroyed identifier with its authenticated data. The default rolling: true behavior is required, no cookie theft or signature forgery is involved, and the attacker gains nothing beyond a session they could already use - the flaw extends or resurrects an existing session rather than creating initial access (CVSS 3.1 base 3.7, AV:N/AC:H/PR:L/UI:R, C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has released a fix in 11.1.6 that adds a per-session generation marker plus a conditional store write.