Skip to content
OpenAdvisories

Vendor

@fastify/oauth2

2 known vulnerabilities.

Products

@fastify/oauth2 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-110008

    @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

    @fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback w…

    @fastify/oauth2 @fastify/oauth2
  • Medium 4.2
    CVE-2026-18165

    @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

    @fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cooki…

    @fastify/oauth2 @fastify/oauth2