EUVD-2026-59767Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Sibling-subdomain cookie write access required (AC:H); victim must participate in OAuth flow (UI:R); impact limited to session confusion with no victim credential exposure (C:L, I:L, A:N).
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the browser that began the flow. Any party able to write a cookie for the application's host, such as a sibling subdomain under the same registrable domain, can plant matching state and verifier cookies and complete an attacker-owned OAuth flow inside a victim's browser, silently signing the victim in to the attacker's account (login CSRF). It does not expose the victim's own account, credentials, or tokens. The issue is fixed in @fastify/oauth2 8.3.0, which adds an opt-in hostPrefixedCookies option. Users should upgrade to 8.3.0 and enable it, or bind state to a server-side session.
AnalysisAI
Login CSRF in @fastify/oauth2 versions 7.2.0 through 8.2.x allows an attacker controlling a sibling subdomain to plant predictable OAuth state and PKCE code verifier cookies, silently signing a victim into the attacker's account instead of their own. The root cause is the absence of server-side session binding and cookie prefixing - the plugin validates OAuth state exclusively by comparing callback parameters against unprefixed cookies, which sibling subdomains sharing the same registrable domain can freely overwrite. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the high attack complexity limits opportunistic risk.
Technical ContextAI
The affected package @fastify/oauth2 implements the OAuth 2.0 authorization code flow as a plugin for the Fastify Node.js web framework. The vulnerability class is CWE-352 (Cross-Site Request Forgery), applied specifically to the OAuth callback validation step. The plugin stores the anti-CSRF state parameter and PKCE code_verifier in HTTP cookies without applying cookie prefixes (__Host- or __Secure-). Browser cookie scoping rules allow any subdomain under the same registrable domain (e.g., evil.example.com) to set cookies readable by the target application (app.example.com). Since the plugin performs no server-side session binding - it simply compares the callback query parameter to whatever cookie is present - an attacker who controls a sibling subdomain can pre-plant matching state and verifier values, neutering both the standard OAuth state CSRF protection and the PKCE extension that was specifically designed to prevent code injection. The affected CPE corresponds to the @fastify/oauth2 npm package in the 7.2.x-8.2.x version range on Node.js.
RemediationAI
Upgrade @fastify/oauth2 to version 8.3.0, which introduces the hostPrefixedCookies option; this option must be explicitly enabled in plugin configuration to apply __Host- cookie prefixing, which browsers enforce to prevent sibling subdomains from overwriting cookies. If an immediate upgrade is not feasible, the alternative fix described in the advisory is to bind OAuth state to a server-side session (e.g., express-session or a custom session store) rather than relying solely on cookie comparison - this eliminates the cookie-injection vector entirely but requires additional session infrastructure. As a compensating control where neither option is immediately available, ensure no untrusted parties control any subdomain under the same registrable domain as the application, reducing the attack surface to zero; however, this is a deployment-level constraint rather than a code-level fix and may be difficult to guarantee over time. Advisory reference: https://github.com/fastify/fastify-oauth2/security/advisories/GHSA-p8h8-rj28-m8q9.
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all req
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
Fastify is a fast and low overhead web framework, for Node.js. Rated high severity (CVSS 7.5), this vulnerability is rem
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: a
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger reso
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Authorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthent
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authoriza
Fastify is a web framework with minimal overhead and plugin architecture. Rated high severity (CVSS 8.8), this vulnerabi
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today