CVE-2026-117499: 
JavaScript vulnerability analysis and mitigation

CVE-2026-117499 is a session revocation bypass vulnerability in @fastify/session, a session plugin for the Fastify Node.js web framework. Due to a race condition in the default rolling session behavior, an attacker who holds a victim's valid signed session cookie can replay it to restore an authenticated session after the victim has logged out. All releases before 11.1.6 are affected. The vulnerability was published on October 27, 2026, and carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory).

The root cause is a race condition (CWE-362) combined with insufficient session expiration (CWE-613). With rolling: true (the default), when a request restores a session from the store before a logout is initiated, it can subsequently write its own copy of the session back to the store after Session#destroy() has completed — effectively recreating the destroyed session identifier with its original authenticated data. This is a time-of-check/time-of-use (TOCTOU) issue (CAPEC-29): the session's validity is checked at request start, but the store write occurs after the destroy, overwriting the revocation. No cookie theft or signature forgery is required; the attacker must already possess the victim's valid signed session cookie and keep a concurrent request in flight across the logout window (GitHub Advisory).

Successful exploitation allows an attacker to maintain authenticated access to a victim's session even after the victim has explicitly logged out, bypassing session revocation. This results in low confidentiality and integrity impact — the attacker can access session-protected resources and perform actions as the victim — but has no availability impact. The scope is limited to the affected application's session store and does not extend to other system components (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to already possess the victim's valid signed session cookie and to time a concurrent in-flight request precisely across the logout window, making opportunistic exploitation unlikely (GitHub Advisory).

1. Obtain a valid session cookie: The attacker must already hold the victim's valid signed @fastify/session cookie — for example, through prior session hijacking, shared device access, or network interception.
2. Initiate a concurrent request: Using the stolen cookie, send a request to the target Fastify application that causes the session to be loaded from the store (e.g., any authenticated endpoint). Keep this request in flight (e.g., via a slow network or deliberate delay).
3. Trigger victim logout: Ensure the victim (or a separate attacker-controlled action) calls Session#destroy() on the server, which deletes the session from the store.
4. Allow the in-flight request to complete: The in-flight request, which loaded the session before the destroy, completes its handler and writes its session copy back to the store — recreating the destroyed session identifier with authenticated data.
5. Replay the original cookie: The attacker replays the original signed session cookie to the application, which now finds the session restored in the store and grants authenticated access as the victim (GitHub Advisory).

• Logs: Application logs showing session activity (reads/writes) for a session ID that was previously destroyed within the same short time window; duplicate session store write events for the same session ID after a destroy event.
• Network: Repeated use of the same session cookie value across requests after a logout event has been recorded server-side.
• Application Behavior: Authenticated API responses returned for session IDs that should have been invalidated, observable via server-side session store audit logs if available.

Upgrade @fastify/session to version 11.1.6 or later, which introduces a per-session generation marker and a conditional store write to prevent a pre-logout session restore from recreating or overwriting the current store entry. There is no workaround available for unpatched versions. Applications using custom session store implementations must also update those stores to implement the new conditional write interface introduced in 11.1.6 (GitHub Advisory).

The advisory was published by Fastify maintainer mcollina on GitHub with credited reporters koyokr and BlueN0r, and notes that the report was submitted with AI assistance. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory).