User impersonation via reusable destroyed session cookie

Insufficient session expiration in Fastify @fastify/secure-session before 7.3.0 allows attackers with a leaked cookie to impersonate users. The delete path only marks the server-side session for removal, while later requests still decrypt the unchanged client-held ciphertext and rebuild an authorized session. Exploitation requires access to a valid cookie and user interaction that leaks it; resulting access is limited to the impersonated session's privileges.