CVE-2026-117499: @fastify/session is a session plugin for Fastify

Routine

LOW 3.7

CVE-2026-117499 is a low-severity flaw (CVSS 3.7) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	3.7 (Low)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	Low
User interaction	Required
EPSS exploit chance	n/a
CISA exploited list	No
Weakness	CWE-362, CWE-613
Published	2026-10-27
Last modified	2026-10-27

Publisher (CNA): openjs

Last updated 2026-10-27 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

2026-10-27 12:17 UTCPublished CVE record published
2026-10-27 12:17 UTCUpdated Record last modified

Advisories and coverage

Research and news

Vulners Bulletins: CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition 2026-10-27
Vulners Bulletins: CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition 2026-10-27

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-117499?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-117499 being exploited?

CVE-2026-117499 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-117499 affect?

CVE-2026-117499 affects affected software. Severity is low (CVSS 3.7). @fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the se

How urgent is CVE-2026-117499?

Priority 13/100. No elevated risk signals yet.

References

← Back to latest CVEs