GHSA-pj27-2xvp-4qxg
@fastify/session reuses destroyed session cookie
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @fastify/session | < 10.9.0 | 10.9.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set.
This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed.
### Patches
Updating to v10.9.0 will solve this.
### Workarounds
None
### References
Publicly reported at: https://github.com/fastify/session/issues/251
References
External links from the advisory. They lead to third-party sites.