Lambda event spoofing via client-controlled header in @fastify/aws-lambda (CVE-2026-18248)

@fastify/aws-lambda 6.4.0 resolves the request.awsLambda.event and request.awsLambda.context decorations from the client-controllable x-apigateway-event and x-apigateway-context HTTP headers, which are not stripped from the incoming event before the request is processed. An unauthenticated remote attacker can forge the entire Lambda proxy event, including API Gateway authorizer context, by setting a single HTTP header. Any application that relies on request.awsLambda.event for identity or access control decisions is subject to full authentication and authorization bypass and privilege escalation. Affected versions: - 6.4.0 We recommend updating to: 6.4.1. CVSS 9.1 · our assessment: act_now Reference: https://github.com/fastify/aws-lambda-fastify/security/advisories/GHSA-m93c-jj3f-68ph Details: https://vuln.today/cve/CVE-2026-18248