Read the docs
TI-2023-15307 Aliases CVE-2023-31999GHSA-g8x5-p9qc-cf95

Cross-site request forgery in npm @fastify/oauth2

Priority HIGH 73CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.

Summary

All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it. v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00705 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial @fastify/oauth2 (npm): v7.2.0, 7.2.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
npm@fastify/oauth2v7.2.0 to before v7.2.0v7.2.0Patch availableCNA
—@fastify/oauth2 (npm)before 7.2.07.2.0Patch availableGHSA-g8x5-p9qc-cf95
  • @fastify/oauth2 Vendornpm Affected v7.2.0 to before v7.2.0 Fixed in v7.2.0 Patch available CNA
  • @fastify/oauth2 (npm) Vendor— Affected before 7.2.0 Fixed in 7.2.0 Patch available GHSA-g8x5-p9qc-cf95

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:oauth2:*:*:*:*:*:*:*:*before 7.2.0Vulnerablefastify
  • cpe:2.3:a:fastify:oauth2:*:*:*:*:*:*:*:* Versions before 7.2.0 Vulnerable ·fastify

Remediation

  • Fix · CNA @fastify/oauth2 (npm) Fixed in v7.2.0
  • Fix · GHSA-g8x5-p9qc-cf95 @fastify/oauth2 (npm) Fixed in 7.2.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-31999
  2. 2026-10-03 Alias added: GHSA-g8x5-p9qc-cf95

References

Exploit 1

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences