CVE-2026-117549

The @fastify/secure-session plugin for Fastify (versions 7.5.0 through 8.4.1 ) contains a vulnerability where it fails to properly reject cookies with invalid signatures when the signed cookie option is enabled. Specifically, the plugin calls the unsign routine but continues to pass the original ...