CVE-2026-110008

Name of the Vulnerable Software and Affected Versions @fastify/oauth2 versions 7.2.0 through 8.3.1

Description In login routes with two or more path segments, the state and code-verifier cookies are set without a Path attribute. Because the clearing step at the OAuth callback uses a root path, the original cookies are not removed. This allows a state value learned by an attacker to remain valid for the duration of the browser session, enabling a login CSRF (Cross-Site Request Forgery) attack where the attacker can drive the authorization flow in the victim's browser to sign the victim into the attacker's account.

Recommendations Update @fastify/oauth2 to version 8.3.2 or later. As a temporary workaround, set an explicit cookie path to ensure the set and clear operations target the same cookie.