CVE-2024-35220

Published: May 21, 2024Modified: Jun 17, 2026Deferred

7.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. This vulnerability has been patched 10.8.0.

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (6)

https://github.com/fastify/session/commit/0495ce5b534c4550f25228821db8098293439f2f

Source: security-advisories@github.com

https://github.com/fastify/session/issues/251

Source: security-advisories@github.com

https://github.com/fastify/session/security/advisories/GHSA-pj27-2xvp-4qxg

Source: security-advisories@github.com

https://github.com/fastify/session/commit/0495ce5b534c4550f25228821db8098293439f2f

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/fastify/session/issues/251

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/fastify/session/security/advisories/GHSA-pj27-2xvp-4qxg

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.