high7.4
CVE-2024-35220
@fastify/session reuses destroyed session cookie
Impact
### Impact When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. ### Patches Updating to v10.9.0 will solve this. ### Workarounds None ### References Publicly reported at: https://github.com/fastify/session/issues/251
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @fastify/session | < 10.9.0 | 10.9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/fastify/session/commit/0495ce5b534c4550f25228821db8098293439f2f
- https://github.com/fastify/session/issues/251
- https://github.com/fastify/session/security/advisories/GHSA-pj27-2xvp-4qxg
- https://github.com/advisories/GHSA-pj27-2xvp-4qxg
- https://nvd.nist.gov/vuln/detail/CVE-2024-35220