Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-18248— @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

Quick assessment

Affected
@fastify/aws-lambda @fastify/aws-lambda
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Fastify @fastify/aws-lambda是Fastify组织的一个在无服务器环境下运行Web应用的适配插件。 Fastify @fastify/aws-lambda 6.4.0版本存在输入验证错误漏洞，该漏洞源于对客户端控制的x-apigateway-event和x-apigateway-context HTTP头处理不当，可能导致未经身份验证的攻击者伪造Lambda代理事件并覆盖真实事件，从而绕过身份验证和授权，实现权限提升。

CVSS 9.1 · Critical EPSS 0.38% · P29

Possible ATT&CK Techniques 1 AI

T1078.003 · Local Accounts

Affected Version Matrix 2

VendorProduct Version RangeStatus
@fastify/aws-lambda @fastify/aws-lambda 6.4.0< 6.4.1 affected
6.4.1 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18248

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populates this decoration reads the client-controlled x-apigateway-event and x-apigateway-context HTTP headers before falling back to the trusted internal request token, and those reserved headers are not stripped from the incoming event. An unauthenticated attacker who can set a single HTTP header can therefore forge the entire Lambda proxy event, including the authorizer context, and override the genuine one. This results in a full authentication and authorization bypass and privilege escalation for any application that trusts request.awsLambda.event for identity or access control. Only version 6.4.0 is affected. Patches: upgrade to @fastify/aws-lambda 6.4.1, which resolves the decoration only through the internal per-invocation token and strips the reserved headers before the request is processed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Vulnerability Title
Fastify @fastify/aws-lambda 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Fastify @fastify/aws-lambda是Fastify组织的一个在无服务器环境下运行Web应用的适配插件。 Fastify @fastify/aws-lambda 6.4.0版本存在输入验证错误漏洞，该漏洞源于对客户端控制的x-apigateway-event和x-apigateway-context HTTP头处理不当，可能导致未经身份验证的攻击者伪造Lambda代理事件并覆盖真实事件，从而绕过身份验证和授权，实现权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/aws-lambda @fastify/aws-lambda 6.4.0 ~ 6.4.1 -

II. Public POCs for CVE-2026-18248

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9696 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-18248

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-18248 (1)

IV. Related Vulnerabilities

Same weakness: CWE-345

V. Comments for CVE-2026-18248

No comments yet

Leave a comment