CVE-2024-35220: Fastify Session

High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days.

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. This vulnerability has been patched 10.8.0.

Affected products

• Fastify Session: before 10.9.0 (fixed in 10.9.0); up to and including 10.8.0

Published 2024-05-21. Last modified 2026-06-17.