Answer in brief
CVE-2023-29020 records a Medium severity (CVSS 6.5) vulnerability in CSRF token fixation in fastify-passport. The current sources do not mark it as known exploited. The current feed maps @fastify/passport (npm), @fastify/passport (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps @fastify/passport (npm), @fastify/passport (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| @fastify/passportnpm | >=0 <1.1.0 | 1.1.0 |
| @fastify/passportnpm | >=2.0.0 <2.3.0 | 2.3.0 |
Published upstream
Apr 21, 2023
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Sep 10, 2026
The [CSRF](https://owasp.org/www-community/attacks/csrf) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport`, can be bypassed by network and same-site attackers. ## Details `fastify/csrf-protection` implements the [synchronizer token pattern](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern) (using plugins `@fastify/session` and `@fastify/secure-session`) by storing a random value used for CSRF token generation in the `_csrf` attribute of a user's session. The `@fastify/passport` library does not clear the session object upon authentication, preserving the `_csrf` attribute between pre-login and authenticated sessions. Consequently, CSRF tokens generated before authentication are still valid. Network and [same-site attackers](https://canitakeyoursubdomain.name/) can thus obtain a CSRF token for their pre-session, fixate that pre-session in the victim's browser via cookie tossing, and then perform a CSRF attack after the victim authenticates. ## Fix As a solution, newer versions of `@fastify/passport` include the configuration options * `clearSessionOnLogin (default: true)` and * `clearSessionIgnoreFields (default: ['session'])` to clear all the session attributes by default, preserving those explicitly defined in `clearSessionIgnoreFields`. ## Credits * Pedro Adão (@pedromigueladao), [Instituto Superior Técnico, University of Lisbon](https://tecnico.ulisboa.pt/) * Marco Squarcina (@lavish), [Security & Privacy Research Unit, TU Wien](https://secpriv.wien/)
Quoted source text, attributed separately from HOL analysis.