CVE-2024-35220

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. This vulnerability has been patched 10.8.0.

• CWE-613

• https://github.com/fastify/session/commit/0495ce5b534c4550f25228821db8098293439f2f
• https://github.com/fastify/session/issues/251
• https://github.com/fastify/session/security/advisories/GHSA-pj27-2xvp-4qxg
• https://github.com/fastify/session/commit/0495ce5b534c4550f25228821db8098293439f2f
• https://github.com/fastify/session/issues/251
• https://github.com/fastify/session/security/advisories/GHSA-pj27-2xvp-4qxg

Published

May 21, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35213An improper input validation vulnerability in the SGI Image …9
• CVE-2024-35214A tampering vulnerability in the CylanceOPTICS Windows Insta…7.1
• CVE-2024-35215NULL pointer dereference in IP socket options processing of …6.2
• CVE-2024-35218Umbraco CMS is an ASP.NET CMS used by more than 730.000 webs…4.8
• CVE-2024-35219OpenAPI Generator allows generation of API client libraries …8.3
• CVE-2024-3522A vulnerability classified as critical has been found in Cam…8.8
• CVE-2024-35221Rubygems.org is the Ruby community's gem hosting service. A …4.3
• CVE-2024-35222Tauri is a framework for building binaries for all major des…5.9
• CVE-2024-35223Dapr is a portable, event-driven, runtime for building distr…5.3
• CVE-2024-35224OpenProject is the leading open source project management so…5.4
• CVE-2024-35225Jupyter Server Proxy allows users to run arbitrary external …6.1
• CVE-2024-35226Smarty is a template engine for PHP, facilitating the separa…7.3