{"action":"Upgrade @fastify/oauth2 to 7.2.0 or later.","affected":[{"fixed":"7.2.0","introduced":"0"}],"component":"@fastify/oauth2","cve_ids":["CVE-2023-31999"],"ecosystem":"npm","epss":0.00705,"exploited":false,"fixed_versions":["7.2.0"],"ghsa_id":"GHSA-g8x5-p9qc-cf95","id":"tcs_01M5KFR2XV6366970790E6MMNJ","modified_at":"2023-11-08T04:12:32.265455Z","published_at":"2023-07-05T21:36:56Z","references":["https://osv.dev/vulnerability/GHSA-g8x5-p9qc-cf95","https://github.com/fastify/fastify-oauth2/security/advisories/GHSA-g8x5-p9qc-cf95","https://nvd.nist.gov/vuln/detail/CVE-2023-35935","https://github.com/fastify/fastify-oauth2/commit/bff756b456cbb769080631af2beb85671ff4c79c","https://auth0.com/docs/secure/attack-protection/state-parameters","https://github.com/fastify/fastify-oauth2","https://github.com/fastify/fastify-oauth2/releases/tag/v7.2.0"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-g8x5-p9qc-cf95","url":"https://osv.dev/vulnerability/GHSA-g8x5-p9qc-cf95"}],"summary":"@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state"}