TI-2024-21098 Aliases CVE-2024-31999 GHSA-9wwp-q7wq-jx35

@fastify/secure-session: Reuse of destroyed secure session cookie

LOW 33CWE-613Published 2024-04-10 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

@festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with a secret key and attach the ciphertext as a cookie value with the defined cookie name. After that, the session on the server side is destroyed. When an encrypted cookie with matching session name is provided with subsequent requests, it will decrypt the ciphertext to get the data. The plugin then creates a new session with the data in the ciphertext. Thus theoretically the web instance is still accessing the data from a server-side session, but technically that session is generated solely from a user provided cookie (which is assumed to be non-craftable because it is encrypted with a secret key not known to the user). The issue exists in the session removal process. In the delete function of the code, when the session is deleted, it is marked for deletion. However, if an attacker could gain access to the cookie, they could keep using it forever. Version 7.3.0 contains a patch for the issue. As a workaround, one may include a "last update" field in the session, and treat "old sessions" as expired.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00617 49th percentileScored 2026-11-07

Fix Fixed fastify-secure-session (fastify): 7.3.0@fastify/secure-session (npm): 7.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fastify	fastify-secure-session	before 7.3.0	7.3.0	Patch available	CNA
—	@fastify/secure-session (npm)	before 7.3.0	7.3.0	Patch available	GHSA-9wwp-q7wq-jx35

fastify-secure-session Vendorfastify Affected before 7.3.0 Fixed in 7.3.0 Patch available CNA
@fastify/secure-session (npm) Vendor— Affected before 7.3.0 Fixed in 7.3.0 Patch available GHSA-9wwp-q7wq-jx35

Remediation

Fix · CNA fastify-secure-session (fastify) Fixed in 7.3.0
Fix · GHSA-9wwp-q7wq-jx35 @fastify/secure-session (npm) Fixed in 7.3.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-31999
2026-10-03 Alias added: GHSA-9wwp-q7wq-jx35

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-31999

Other 3

TI-2026-26180 @fastify/express vulnerable to middleware authentication bypass via URL normalization… CVSS 4.0CRITICAL 9.1
TI-2026-26179 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
TI-2026-26177 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVSS 4.0CRITICAL 9.0
TI-2026-05498 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
TI-2023-15307 Cross-site request forgery in npm @fastify/oauth2 CVSS 3.1HIGH 8.8
TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5

See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences