Session fixation in fastify-passport
Applications using @fastify/passport for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers.
Details
fastify applications rely on the @fastify/passport library for user authentication. The login and user validation are performed by the authenticate function. When executing this function, the sessionId is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid sessionId cookie in the victim's browser and waiting for the victim to log in on the website.
Fix
As a solution, newer versions of @fastify/passport regenerate sessionId upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session.
Credits
- Pedro Adão (@pedromigueladao), Instituto Superior Técnico, University of Lisbon
- Marco Squarcina (@lavish), Security & Privacy Research Unit, TU Wien
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @fastify/passport | < 1.1.0, >= 2.0.0, < 2.3.0 | 1.1.0, 2.3.0 |
References
- https://github.com/fastify/fastify-passport/security/advisories/GHSA-4m3m-ppvx-xgw9
- https://nvd.nist.gov/vuln/detail/CVE-2023-29019
- https://github.com/fastify/fastify-passport/commit/43c82c321db58ea3e375dd475de60befbfcf2a11
- https://github.com/fastify/fastify-passport
- https://owasp.org/www-community/attacks/Session_fixation
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-384- Platform
- npm
- Package
@fastify/passport- Disclosed
- 21.04.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4m3m-ppvx-xgw9 - CC BY 4.0
Vulnerability history: @fastify/passport
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 04.2023 04.2023
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 1
Disclosures per year
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 0
-
Session fixation in fastify-passport this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.