Is CVE-2026-110008 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110008 being exploited in the wild.

How severe is CVE-2026-110008?

Medium severity, with a CVSS score of 4.2, published 19 October 2026.

Which products and versions are affected?

Fastify @Fastify/Oauth2 7.2.0 through 8.3.1.

How is CVE-2026-110008 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110008?

Check whether you run Fastify @Fastify/Oauth2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110008: @fastify/oauth2 login CSRF via state cookie not cleared after callback

CVE-2026-110008 · Severity: medium · CVSS 4.2 · Published 2026-10-19

@fastify/oauth2 is a Fastify plugin that handles OAuth2 login flows. A flaw in versions 7.2.0 through 8.3.1 allows attackers to learn a state cookie value and reuse it to log victims into attacker-controlled accounts, because the cookie is set at a login route path but only cleared at the root path. An attacker can drive an OAuth flow in a victim's browser to achieve login CSRF without exposing the victim's credentials or tokens.

Vendors: Fastify.

Quick answers

Is CVE-2026-110008 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110008 being exploited in the wild.
How severe is CVE-2026-110008?: Medium severity, with a CVSS score of 4.2, published 19 October 2026.
Which products and versions are affected?: Fastify @Fastify/Oauth2 7.2.0 through 8.3.1.
Is there a fix for CVE-2026-110008?: Yes: fixed in @fastify/oauth2 8.3.2. Until then: Set cookie: { path: '/' } in the plugin options to ensure set and clear operations use the same path, or enable hostPrefixedCookies: true (which requires HTTPS) to use __Host- prefixed cookie names. Alternatively, use a single-segment startRedirectPath such as /login. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110008 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110008?: Check whether you run Fastify @Fastify/Oauth2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: @fastify/oauth2 8.3.2

Set cookie: { path: '/' } in the plugin options to ensure set and clear operations use the same path, or enable hostPrefixedCookies: true (which requires HTTPS) to use __Host- prefixed cookie names. Alternatively, use a single-segment startRedirectPath such as /login.

Technical details

The vulnerability arises from path mismatch during cookie lifecycle: when startRedirectPath has two or more segments and no explicit cookie.path is set, the state and code-verifier cookies are created without a Path attribute (defaulting to the login route's path) but cleared with Path=/. This causes the cookies to survive the OAuth callback, violating the documented single-use guarantee. An attacker observing the state value in authorization URLs can replay it to trigger login CSRF. Attack requires network access and user interaction (visiting an attacker-controlled link in the victim's browser).

Affected products

Fastify @fastify/oauth2 7.2.0 through 8.3.1

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.