LiveActive security incident?Get immediate response
CVE Record

CVE-2023-31999: All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used a...

All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it. v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

@fastify/oauth2 reused one OAuth state value across requests and users. That weakens a standard CSRF defense in OAuth login flows. The issue matters most for applications where account linking or login actions could be abused. Public sources do not provide CVSS, KEV listing, or evidence of active exploitation.

Executive priority

Prioritize remediation for externally accessible services that use OAuth login with @fastify/oauth2. Treat this as a moderate identity-flow risk, not a confirmed breach indicator. Schedule upgrade and regression testing rather than emergency incident response unless local evidence suggests abuse.

Technical view

The package generated the OAuth2 state parameter once at startup and reused it globally. OAuth state should be unique per user and tied to a session. Version 7.2.0 changed default behavior to generate per-user state stored in an http-only, SameSite=Lax cookie, with a breaking checkStateFunction signature change.

Likely exposure

Exposure is likely limited to Node.js/Fastify applications using @fastify/oauth2 for OAuth login flows, especially default or weak custom state handling. The source bundle does not identify downstream products or exact affected version ranges beyond the description and v7.2.0 release change.

Exploitation context

Sources describe a CSRF weakness in OAuth state handling. There is no KEV entry and no cited source in the bundle claiming active exploitation. Practical impact depends on the application’s OAuth flow, session handling, and whether state validation was customized.

Researcher notes

The CVE record lacks CVSS and CWE data. The key evidence is the project description and v7.2.0 release behavior change. Avoid assuming exploitability across all deployments; validate actual OAuth state handling and any application-specific session binding.

Mitigation direction

  • Review @fastify/oauth2 usage in OAuth login and account-linking routes.
  • Plan upgrade to @fastify/oauth2 v7.2.0 after testing compatibility.
  • Update custom checkStateFunction code for the new Request object signature.
  • Ensure OAuth state is unique per user and bound to session context.
  • Check vendor release notes before relying on compensating controls.

Validation and detection

  • Inventory package-lock or npm manifests for @fastify/oauth2 usage.
  • Confirm deployed version and whether v7.2.0 behavior is active.
  • Review OAuth routes for custom state generation or validation.
  • Verify state is not static across users or server lifetime.
  • Regression-test OAuth login after upgrading because v7.2.0 is breaking.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-31999 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
npm@fastify/oauth2v7.2.0unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.