Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@fastify/oauth2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.4npmAmendedPublished

    @fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state

    CVE-2023-31999 · GHSA-g8x5-p9qc-cf95

    Affected
    • npm @fastify/oauth2 < 7.2.0
    Fixed in
    7.2.0· Vendor fix available
    Issue
    Impact All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it. Patches v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object. Workarounds There are no known workarounds. References Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters

    Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →