diff --git a/src/Server/Session/Session.php b/src/Server/Session/Session.php
index b2e91ba0..fe022557 100644
--- a/src/Server/Session/Session.php
+++ b/src/Server/Session/Session.php
@@ -171,6 +171,12 @@ private function readData(): array
             return $this->data = [];
         }
 
-        return $this->data = json_decode($rawData, true, flags: \JSON_THROW_ON_ERROR);
+        $decoded = json_decode($rawData, true, flags: \JSON_THROW_ON_ERROR);
+
+        if (!\is_array($decoded)) {
+            return $this->data = [];
+        }
+
+        return $this->data = $decoded;
     }
 }
diff --git a/tests/Unit/Server/Session/SessionTest.php b/tests/Unit/Server/Session/SessionTest.php
index db331a05..01e88bc3 100644
--- a/tests/Unit/Server/Session/SessionTest.php
+++ b/tests/Unit/Server/Session/SessionTest.php
@@ -33,4 +33,18 @@ public function testAll()
         $result = $session->all();
         $this->assertEquals(['foo' => 'bar'], $result);
     }
+
+    public function testAllReturnsEmptyArrayForNullPayload()
+    {
+        $store = $this->getMockBuilder(InMemorySessionStore::class)
+            ->disableOriginalConstructor()
+            ->onlyMethods(['read'])
+            ->getMock();
+        $store->expects($this->once())->method('read')->willReturn('null');
+
+        $session = new Session($store);
+        $result = $session->all();
+
+        $this->assertSame([], $result);
+    }
 }