Fastify Aws Lambda
Monthly
Authentication and authorization bypass in @fastify/aws-lambda 6.4.0 lets an unauthenticated remote attacker forge the entire AWS Lambda proxy event by setting a single client-controlled HTTP header. Because the request.awsLambda.event/context decoration reads the untrusted x-apigateway-event and x-apigateway-context headers before falling back to the trusted internal invocation token, any application that consults these values for identity or API Gateway authorizer claims can be tricked into granting attacker-chosen access, enabling full privilege escalation. Rated CVSS 9.1; no public exploit identified at time of analysis, but the attack is trivial and documented in the vendor advisory.
Authentication and authorization bypass in @fastify/aws-lambda 6.4.0 lets an unauthenticated remote attacker forge the entire AWS Lambda proxy event by setting a single client-controlled HTTP header. Because the request.awsLambda.event/context decoration reads the untrusted x-apigateway-event and x-apigateway-context headers before falling back to the trusted internal invocation token, any application that consults these values for identity or API Gateway authorizer claims can be tricked into granting attacker-chosen access, enabling full privilege escalation. Rated CVSS 9.1; no public exploit identified at time of analysis, but the attack is trivial and documented in the vendor advisory.