What is the CVSS score of EUVD-2026-52329?

EUVD-2026-52329 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of @fastify/aws-lambda are affected by EUVD-2026-52329?

A critical authentication bypass in @fastify/aws-lambda 6.4.0 allows unauthenticated remote attackers to forge AWS Lambda authorization claims by manipulating a single HTTP header, enabling complete…. A patch is available.

How to fix or mitigate EUVD-2026-52329?

Within 24 hours: Identify all deployments of @fastify/aws-lambda 6.4.0 and implement immediate header filtering at the API Gateway layer to block or sanitize x-apigateway-event and x-apigateway-context headers from external traffic. Within 7 days: Complete inventory of affected applications, validate that header filtering is operational across all entry points, and establish monitoring for suspicious header manipulation attempts. Within 30 days: Prepare application-level remediation by implementing IAM-based authentication or JWT validation independent of the Lambda event decoration, test migration strategy for patched versions once released, and establish timeline for upgrading all instances.

@fastify/aws-lambda EUVD-2026-52329

| CVE-2026-18248 CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-08-03 openjs

Privilege Escalation Fastify Aws Lambda

9.1

CVSS 3.1 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

One forgeable header gives unauthenticated remote impersonation, so AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 03, 2026 - 16:01 EUVD

Analysis Generated

Aug 03, 2026 - 15:51 vuln.today

CVE Published

Aug 03, 2026 - 15:20 cve.org

CRITICAL 9.1

DescriptionCVE.org

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populates this decoration reads the client-controlled x-apigateway-event and x-apigateway-context HTTP headers before falling back to the trusted internal request token, and those reserved headers are not stripped from the incoming event. An unauthenticated attacker who can set a single HTTP header can therefore forge the entire Lambda proxy event, including the authorizer context, and override the genuine one. This results in a full authentication and authorization bypass and privilege escalation for any application that trusts request.awsLambda.event for identity or access control. Only version 6.4.0 is affected. Patches: upgrade to @fastify/aws-lambda 6.4.1, which resolves the decoration only through the internal per-invocation token and strips the reserved headers before the request is processed.

AnalysisAI

Authentication and authorization bypass in @fastify/aws-lambda 6.4.0 lets an unauthenticated remote attacker forge the entire AWS Lambda proxy event by setting a single client-controlled HTTP header. Because the request.awsLambda.event/context decoration reads the untrusted x-apigateway-event and x-apigateway-context headers before falling back to the trusted internal invocation token, any application that consults these values for identity or API Gateway authorizer claims can be tricked into granting attacker-chosen access, enabling full privilege escalation. Rated CVSS 9.1; no public exploit identified at time of analysis, but the attack is trivial and documented in the vendor advisory.

Technical ContextAI

@fastify/aws-lambda (aws-lambda-fastify) is an adapter that lets a Fastify HTTP application run inside an AWS Lambda function behind API Gateway/ALB by translating the Lambda proxy integration event into a synthetic Fastify request. It decorates each request with request.awsLambda.event and request.awsLambda.context so handlers can read Lambda-specific context - notably event.requestContext.authorizer, which carries claims produced by an API Gateway authorizer and is commonly trusted for authorization. The root cause maps to CWE-345 (Insufficient Verification of Data Authenticity): the getter populating this decoration prefers the inbound x-apigateway-event and x-apigateway-context HTTP headers over the adapter's internal per-invocation token, and these reserved headers are not stripped from the incoming event, so client-supplied data is treated as trusted platform-supplied data. The single affected package is identified by cpe:2.3:a:@fastify/aws-lambda:@fastify/aws-lambda:*:*:*:*:*:*:*:* and only release 6.4.0 exhibits the flaw.

RemediationAI

Vendor-released patch: upgrade @fastify/aws-lambda from 6.4.0 to 6.4.1, which resolves the decoration exclusively through the internal per-invocation token and strips the reserved x-apigateway-event and x-apigateway-context headers before the request is processed; this is the primary and complete fix. As an interim compensating control if you cannot upgrade immediately, strip or reject the x-apigateway-event and x-apigateway-context request headers at the edge (API Gateway mapping, ALB rules, WAF, or a Fastify onRequest hook) so client-supplied values never reach the getter - the trade-off is that any legitimate use of those exact reserved header names would also be blocked, which is acceptable. Additionally, avoid trusting request.awsLambda.event for authorization until patched, preferring a verified identity source. See https://github.com/fastify/aws-lambda-fastify/security/advisories/GHSA-m93c-jj3f-68ph and https://cna.openjsf.org/security-advisories.html.