CVE-2026-18165

COMPONENT VERSION RANGE

NewScan fingerprints @fastify/oauth2 from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-16. Rated medium rather than high because it needs a foothold first - XSS on any related host, a subdomain takeover, or anything else that can set a cookie on the parent domain - but the payoff is the reason it is worth a row: the state and code_verifier cookies (`oauth2-redirect-state`, `oauth2-code-verifier`) carry no integrity binding to the session, so a planted pair lets the attacker finish THEIR authorization inside the victim's browser. Nothing of the victim's leaks; instead everything the victim then does is written into the attacker's account, which is the direction people forget to threat-model. Fixed in 8.3.0, which adds the opt-in hostPrefixedCookies:true (__Host- names browsers refuse from related hosts) - note the FIX IS OPT-IN, so 8.3.0 alone is not proof the app is safe, only that the option exists; the version gate is therefore the honest floor and not a full answer. Version source: the npm manifests in version_tools._MANIFESTS. INERT ON EXISTING INSTALLS until the release carrying the scoped-name lookup - see the @fastify/jwt note.