@fastify/session vulnerabilities

CVEs whose affected-version data names the @fastify/session package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-117499Low· 3.7

yesterday

@fastify/session vulnerable to session revocation bypass via a logout race condition

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the…

▾ Sunlit@fastify/session · @fastify/sessionvia CVEORG