Skip to content
Fencer Vulns
high 8.8

CVE-2023-31999 json

@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state

published 2023-07-04 3 y ago modified 2026-06-17 4 mo ago also GHSA-g8x5-p9qc-cf95 , EUVD-2023-2056

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it.

v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.

Patch / fix

  • npm @fastify/oauth2 7.2.0
  • fastify oauth2 7.2.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-31999 updated cvss 7.4

fastify-oauth2: CSRF due to reused Oauth2 state

  • Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel8
    affected: no fix available

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
23 mo ago

Exploit prediction

0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • auth0.com https://auth0.com/docs/secure/attack-protection/state-parameters referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm @fastify/oauth2
<7.2.0
7.2.0

Affected products

  • npm @fastify/oauth2

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.