Authorization Bypass Vulnerability in @fastify/aws-lambda by Fastify

CVE-2026-18248

What is CVE-2026-18248?

The @fastify/aws-lambda version 6.4.0 contains a vulnerability that allows an unauthenticated attacker to forge Lambda proxy events. By manipulating HTTP headers, specifically the x-apigateway-event and x-apigateway-context, attackers can bypass genuine authentication and authorization mechanisms. This flaw arises from the default configuration which processes client-controlled headers before falling back to trusted internal tokens. Applications relying on request.awsLambda.event for identity validation can be compromised, allowing unauthorized access and escalation of privileges. Users are advised to upgrade to version 6.4.1, which implements security measures to mitigate this issue by stripping out reserved headers.

References