AIKIDO-2026-293375
@middy/http-response-serializer is vulnerable to Regular Expression Denial of Service (ReDoS)
54
Medium Risk
This Affects:
@middy/http-response-serializerTL;DR
The http-response-serializer middleware selects a response serializer by testing request-negotiated media types against configured serializer regular expressions and reflects the matched media type into the Content-Type response header. It does not bound the media-type length or validate its grammar, so an attacker who controls the negotiated media types can supply very long or crafted values. This can drive catastrophic backtracking in serializer regular expressions and echo attacker-controlled strings into the response header. The fix caps media-type length at 128 characters and validates each value against a media-type grammar before matching or reflecting it.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and responses are serialized based on untrusted negotiated media types.
Background info
@middy/http-response-serializer is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 1.0.0 - 7.6.7.
How to fix this
Upgrade the @middy/http-response-serializer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant