AIKIDO-2026-132102
@fastify/aws-lambda is vulnerable to Authentication Bypass
91
Critical Risk
This Affects:
@fastify/aws-lambdaTL;DR
The request.awsLambda decoration, which exposes event and context for handlers that read API Gateway authorizer claims, resolves those values from the client-controlled x-apigateway-event and x-apigateway-context headers before falling back to the internal per-invocation token, and those reserved headers are not stripped from the incoming proxy event. An unauthenticated caller who can set a single HTTP header can therefore forge the entire Lambda event, including requestContext.authorizer, and override the genuine one. Any application that trusts request.awsLambda.event for identity or access control can be fully authentication- and authorization-bypassed. The fix resolves the decoration only through the internal token map and strips the reserved headers before the request is injected.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application trusts request.awsLambda.event or request.awsLambda.context for authentication or authorization decisions.
Background info
@fastify/aws-lambda is vulnerable to Authentication Bypass in versions 6.4.0 - 6.4.0.
How to fix this
Upgrade the @fastify/aws-lambda library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant