CVE-2024-35220

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. This vulnerability has been patched 10.8.0.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
fastify	session	< 10.9.0
fastify	session	<= 10.8.0

References

Timeline

Published: May 21, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-352214.3Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how R CVE-2024-352225.9Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri CVE-2024-352235.3Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invok CVE-2024-352245.4OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. Th CVE-2024-352256.1Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access t CVE-2024-352267.3Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions tem CVE-2024-352277.5Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed`CVE-2024-352285.5Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.s CVE-2024-352295.3ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern CVE-2024-35238.8A vulnerability classified as critical was found in Campcodes Online Event Management System 1.0. This vulnerability affects unknown code of CVE-2024-352305.3GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the we CVE-2024-352318.6rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5