Npm · @Fastify/Oauth2 · CVE-2026-110008
**Name of the Vulnerable Software and Affected Versions**
@fastify/oauth2 versions 7.2.0 through 8.3.1
**Description**
In login routes with two or more path segments, the state and code-verifier cookies are set without a Path attribute. Because the clearing step at the OAuth callback uses a root path, the original cookies are not removed. This allows a state value learned by an attacker to remain valid for the duration of the browser session, enabling a login CSRF (Cross-Site Request Forgery) attack where the attacker can drive the authorization flow in the victim's browser to sign the victim into the attacker's account.
**Recommendations**
Update @fastify/oauth2 to version 8.3.2 or later.
As a temporary workaround, set an explicit cookie path to ensure the set and clear operations target the same cookie.