After briefly reading up on session fixation, my initial impression is that express-session in its default configuration is practically immune, and the attack is only viable if the site already has an XSS vulnerability.

With the warning/medium classification I think that's fine, but I'm curious if I missed anything?

I don't think you did.
But some developers care about it anyway.

Thanks for all your work on security analysis! I just wanted to update here that the latest version of passport, 0.6.0, is now actively defending against session fixation attacks by default. Sessions are regenerated internally, and there's no longer any need to do it at the application-level. The announcement has more info. Let me know if you want any further details.

Thanks for all your work on security analysis! I just wanted to update here that the latest version of passport, 0.6.0, is now actively defending against session fixation attacks by default. Sessions are regenerated internally, and there's no longer any need to do it at the application-level. The announcement has more info. Let me know if you want any further details.

Thanks for the heads up. I'll remove passport from our query.

If you create a security advisory (and possibly request a CVE), then more people will probably upgrade to the new version.