CVE-2026-18248

Name of the Vulnerable Software and Affected Versions @fastify/aws-lambda version 6.4.0

Description In the default configuration, the getter that populates request decorations reads the client-controlled x-apigateway-event and x-apigateway-context HTTP headers before falling back to the trusted internal request token. Because these reserved headers are not stripped from the incoming event, an unauthenticated attacker can set these headers to forge the entire Lambda proxy event, including the authorizer context. This allows the attacker to override genuine data, leading to a full authentication and authorization bypass and privilege escalation for applications that rely on request.awsLambda.event or request.awsLambda.context for identity or access control.

Recommendations Upgrade to @fastify/aws-lambda version 6.4.1.