cvesecurityvulnerability
BREAKING: CVE-2026-18165 - @fastify/oauth2 Login CSRF via Plantable State Cookies
@fastify/oauth2 7.2.0 through 8.2.0 accepts plantable OAuth state cookies from related hosts, enabling login CSRF. Upgrade to 8.3.0 and enable hostPrefixedCookies.
