https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T13:09:30.212116+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-5602 EUVD-2026-5602 2026-10-07T13:09:30.268588+00:00 EUVD-2026-5602 https://cve.radiocsirt.org/vuln/fkie_cve-2024-35220 fkie_cve-2024-35220 2026-10-07T13:09:30.268652+00:00

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. This vulnerability has been patched 10.8.0.

 https://cve.radiocsirt.org/vuln/ghsa-pj27-2xvp-4qxg GHSA-pj27-2xvp-4qxg — @fastify/session reuses destroyed session cookie 2026-10-07T13:09:30.268704+00:00

Affected: npm: @fastify/session

### Impact

When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed.

### Patches

Updating to v10.9.0 will solve this.

### Workarounds

None

### References

Publicly reported at: https://github.com/fastify/session/issues/251