# CVE-2026-117549: @fastify/secure-session signature verification bypass via cookie signature removal

Source: https://junglewise.ai/threats/cve-2026-117549-fastify-secure-session-is-a-session-plugin-for-fastify-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-117549 · Severity: medium · CVSS 4.2 · Published 2026-11-02

@fastify/secure-session is a Fastify plugin that encrypts and stores user session data in cookies. When configured to use signed cookies, the plugin fails to reject sessions with tampered or removed signatures, allowing an attacker who possesses an old session cookie to strip the signature and reuse it indefinitely. This can lead to unauthorized session access even after the signing secret is rotated.

Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-117549 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117549 being exploited in the wild.

**How severe is CVE-2026-117549?** Medium severity, with a CVSS score of 4.2, published 2 November 2026.

**Which products and versions are affected?** OpenJS Foundation @Fastify/Secure-Session 7.5.0 through 8.4.1.

**Is there a fix for CVE-2026-117549?** Yes: fixed in @fastify/secure-session 8.4.2. Until then: As a workaround, rotate the session encryption key (the first entry in the key array) to retire existing sessions, rather than relying solely on rotation of the cookie signing secret. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117549 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-117549?** Check whether you run OpenJS Foundation @Fastify/Secure-Session at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in @fastify/secure-session 8.4.2

As a workaround, rotate the session encryption key (the first entry in the key array) to retire existing sessions, rather than relying solely on rotation of the cookie signing secret.

## Technical details

The vulnerability is a cryptographic signature verification bypass in @fastify/secure-session versions 7.5.0 through 8.4.1. When the cookie.signed option is enabled, the plugin invokes fastify.unsignCookie() to validate the cookie signature; however, if the signature check fails, the code still passes the original (unsigned) cookie value to the session decoder, allowing decryption of an invalidly signed session. An attacker with a valid encrypted session cookie can remove its signature and continue using the session. The attacker must already possess an unexpired session cookie and requires neither the signing secret nor the encryption key; the attack does not forge data, extend expiry, or survive encryption key rotation.

## Affected products

- OpenJS Foundation @fastify/secure-session 7.5.0 through 8.4.1

## Timeline

- 2026-11-02: disclosed

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-4cgq-x5f7-r8jv](https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-4cgq-x5f7-r8jv)