High severity7.4OSV Advisory· Published May 21, 2024· Updated Apr 15, 2026
CVE-2024-35220
CVE-2024-35220
Description
@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. This vulnerability has been patched 10.8.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@fastify/sessionnpm | < 10.9.0 | 10.9.0 |
Affected products
2Patches
Vulnerability mechanics
References
5News mentions
0No linked articles in our index yet.