VulnSea

@fastify/secure-session vulnerabilities

CVEs whose affected-version data names the @fastify/secure-session package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-117549Medium· 4.2
6d ago

@fastify/secure-session vulnerable to signature verification bypass via cookie signature removal

@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, w…

▾ Sunlit@fastify/secure-session · @fastify/secure-sessionEPSS 0.07%via CVEORG
@fastify/secure-session vulnerabilities (CVEs) · VulnSea