CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

@leighton-digital/api-test-harness (>=1.1.2, <=1.1.3), @webiny/ai-powerups (>=0.0.0-unstable.9f53ea597d, <=6.5.0-beta.4) +67 more potentially affected by CVE-2026-18248 via @fastify/aws-lambda (6.4.0)

@fastify/aws-lambda NPM version 6.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/aws-lambda and may be impacted: - @leighton-digital/api-test-harness =1.1.2, =0.0.0-unstable.9f53ea597d, =0.0.0-unstable.6844005670,...

CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-18248

CVE-2026-18248 affects @fastify/aws-lambda 6.4.0, where request.awsLambda.event and request.awsLambda.context are decorated using client-controlled x-apigateway-event and x-apigateway-context headers. The getter may read untrusted headers before the internal per-invocation token, leaving reserved...

CVE-2026-18248: Insufficient Verification of Data Authenticity

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...