CVE-2026-18248

CVE-2026-18248 affects @fastify/aws-lambda 6.4.0, where request.awsLambda.event and request.awsLambda.context are decorated using client-controlled x-apigateway-event and x-apigateway-context headers. The getter may read untrusted headers before the internal per-invocation token, leaving reserved...

CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...