CVE-2026-117499: @fastify/session vulnerable to session revocation bypass via a logout race condition
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@fastify/sessionto a version that resolves this vulnerability.Fixed in 11.1.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using @fastify/session releases before 11.1.6 with the default rolling session behavior are exposed. Exploitation also depends on the attacker already possessing a victim's valid signed session cookie.
What does an attacker need to do to exploit the race?
The attacker must keep a request using the valid session cookie in flight across the victim's logout. The request must have restored the session before logout, allowing it to save authenticated session data after the session destroy operation completes.
Is there a mitigation if upgrading cannot happen immediately?
No workaround is provided. Upgrade to @fastify/session 11.1.6 or later; custom session stores must implement the new conditional write behavior.
How can I determine whether my deployment is affected?
Check whether @fastify/session is below version 11.1.6 and whether rolling session behavior is enabled by default or in your configuration. Also verify that any custom session store supports the conditional write required by the fixed release.