AIKIDO-2026-531396

@fastify/oauth2 is vulnerable to Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF)CVE-2026-18165 Published 3 days ago

Medium Risk

This Affects:

@fastify/oauth2

7.2.0 - 8.2.1

Fixed in 8.3.0

Are you affected? Scan for Free

TL;DR

The plugin validates the OAuth state and, with PKCE, the code_verifier by comparing callback query parameters against cookies it set at the start of the flow. Those cookies use unprefixed, host-scoped names, so any party that can write a cookie for the application host can supply matching values, and the check only proves the query and cookie agree rather than that the same browser started the flow. A party controlling a sibling host under the registrable domain can plant both cookies and complete their own authorization flow inside a victim's browser, silently signing the victim into an account they control so subsequent activity is recorded against it. The fix ships an opt-in hostPrefixedCookies flag that switches the state and verifier cookies to __Host- prefixed names browsers refuse from a related host, safely rejects invalid signed cookies instead of falling back to raw values, and clears the state and verifier cookies after callback processing to prevent replay.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range, use @fastify/oauth2 for OAuth login with the built-in state validation (the default checkStateFunction, not a server-side session binding), and another host under the same registrable domain can set cookies for your application (for example an untrusted or forgotten subdomain, a dangling DNS record, or the same host over plaintext HTTP).

Background info

@fastify/oauth2 is vulnerable to Cross-Site Request Forgery (CSRF) in versions 7.2.0 - 8.2.1.

How to fix this

Upgrade the @fastify/oauth2 library to the patch version and enable hostPrefixedCookies: true (HTTPS required), or set __Host- prefixed cookie names with secure: true and path: '/'. Alternatively, bind state to a server-side session with generateStateFunction and checkStateFunction.