CVE-2026-18165 @fastify/oauth2 CVE debrief

Who should care

Fastify/oauth2 users, particularly those who use OAuth 2.0 for authentication, should be aware of this vulnerability and take steps to mitigate it. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed. Users should prioritize upgrading to version 8.3.0 or later and enabling hostPrefixedCookies to mitigate login CSRF attacks. Additionally, binding state to a server-side session, monitoring for suspicious OAuth activity, and performing inventory checks for affected versions are recommended.

Technical summary

The @fastify/oauth2 plugin for Fastify has a login CSRF vulnerability in versions from 7.2.0 up to but not including 8.3.0. The issue allows an attacker to plant matching state and verifier cookies and complete an attacker-owned OAuth flow inside a victim's browser, silently signing the victim in to the attacker's account. The vulnerability is due to the plugin validating the OAuth state and code verifier by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the browser that began the flow.

Defensive priority

Fastify/oauth2 users should prioritize upgrading to version 8.3.0 or later and enabling hostPrefixedCookies to mitigate login CSRF attacks.

Recommended defensive actions

• Upgrade to @fastify/oauth2 version 8.3.0 or later
• Enable hostPrefixedCookies option
• Bind state to a server-side session
• Monitor for suspicious OAuth activity
• Perform inventory checks for affected versions

Evidence notes

The @fastify/oauth2 plugin for Fastify has a login CSRF vulnerability in versions from 7.2.0 up to but not including 8.3.0. The issue allows an attacker to plant matching state and verifier cookies and complete an attacker-owned OAuth flow inside a victim's browser, silently signing the victim in to the attacker's account. The vulnerability is due to the plugin validating the OAuth state and code verifier by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the browser that began the flow.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.