Description
@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populates this decoration reads the client-controlled x-apigateway-event and x-apigateway-context HTTP headers before falling back to the trusted internal request token, and those reserved headers are not stripped from the incoming event. An unauthenticated attacker who can set a single HTTP header can therefore forge the entire Lambda proxy event, including the authorizer context, and override the genuine one. This results in a full authentication and authorization bypass and privilege escalation for any application that trusts request.awsLambda.event for identity or access control. Only version 6.4.0 is affected. Patches: upgrade to @fastify/aws-lambda 6.4.1, which resolves the decoration only through the internal per-invocation token and strips the reserved headers before the request is processed.
Published: 2026-08-03
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability occurs when the AWS Lambda decorator reads client‑controlled HTTP headers x-apigateway-event and x-apigateway-context, which can contain forged Lambda event data. An attacker can set these headers to impersonate arbitrary identities, bypassing authentication and authorization. The weakness is trust of untrusted input for credential decisions (CWE-345). The impact is full privilege escalation for affected applications.

Affected Systems

Affected vendor and product is @fastify/aws-lambda. Only version 6.4.0 is impacted; all other versions are not vulnerable.

Risk and Exploitability

The CVSS score of 9.1 indicates critical severity. EPSS is not available, but the lack of a listed KEV suggests no known exploit yet. The vulnerability can be exploited remotely by sending a single HTTP header containing forged event data, allowing an attacker to spoof the Lambda proxy event and override the genuine authorizer context. This grants attacker complete control over identity and access within the application.

Generated by OpenCVE AI on August 4, 2026 at 10:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade @fastify/aws-lambda to 6.4.1 or newer to apply the fix that restricts decoration to the internal per-invocation token and strips reserved headers.
  • Configure your HTTP server or load balancer to strip or reject the x-apigateway-event and x-apigateway-context headers before they reach the application.
  • Review any code that uses request.awsLambda.event for authorization decisions and refactor it to rely on a trusted source, such as a validated internal token, rather than the potentially tampered value.

Generated by OpenCVE AI on August 4, 2026 at 10:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Fastify
Fastify aws-lambda
Vendors & Products Fastify
Fastify aws-lambda

Mon, 03 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populates this decoration reads the client-controlled x-apigateway-event and x-apigateway-context HTTP headers before falling back to the trusted internal request token, and those reserved headers are not stripped from the incoming event. An unauthenticated attacker who can set a single HTTP header can therefore forge the entire Lambda proxy event, including the authorizer context, and override the genuine one. This results in a full authentication and authorization bypass and privilege escalation for any application that trusts request.awsLambda.event for identity or access control. Only version 6.4.0 is affected. Patches: upgrade to @fastify/aws-lambda 6.4.1, which resolves the decoration only through the internal per-invocation token and strips the reserved headers before the request is processed.
Title @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
Weaknesses CWE-345
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Fastify Aws-lambda
cve-icon MITRE

Status: PUBLISHED

Assigner: openjs

Published:

Updated: 2026-08-03T19:35:15.263Z

Reserved: 2026-07-29T15:05:55.699Z

Link: CVE-2026-18248

cve-icon Vulnrichment

Updated: 2026-08-03T19:35:11.237Z

cve-icon NVD

Status : Received

Published: 2026-08-03T16:16:28.247

Modified: 2026-08-03T20:17:14.680

Link: CVE-2026-18248

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:22:11Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity