@fastify/oauth2 vulnerabilities

CVEs whose affected-version data names the @fastify/oauth2 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110008Medium· 4.2

today

@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step a…

▾ Sunlit@fastify/oauth2 · @fastify/oauth2via CVEORG