Homepage

@fastify/session@11.1.4

a session plugin for fastify

  • latest version

    11.1.6

  • latest non vulnerable version

    11.1.6

  • first published

    5 years ago

  • latest version published

    1 days ago

  • licenses detected

  • View session package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @fastify/session package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • L
    Race Condition

    @fastify/session is an a session plugin for fastify

    Affected versions of this package are vulnerable to Race Condition via Session.decodeSessionId and the session restoration logic in index.js, where a stale or superseded session cookie can be used to restore a session that should no longer be valid. An attacker who holds an old session identifier can replay it to regain access to a session that has been regenerated, because the generation check (getSessionGeneration) was absent, allowing the store lookup to succeed and the old session to be restored without verifying that the cookie's embedded generation matches the stored session's current generation.

    How to fix Race Condition?

    Upgrade @fastify/session to version 11.1.6 or higher.

    <11.1.6
    Go back to all versions of this package