CVE-2026-18248: Fastify AWS Lambda Auth Bypass Vulnerability

CVE-2026-18248 Overview

CVE-2026-18248 is a critical authentication and authorization bypass in @fastify/aws-lambda version 6.4.0. The library decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, which applications commonly consult for identity and access decisions such as reading API Gateway authorizer claims. In the default configuration, the decoration getter reads the client-controlled x-apigateway-event and x-apigateway-context HTTP headers before falling back to the trusted internal per-invocation token. The reserved headers are not stripped from the incoming event, allowing an unauthenticated attacker to forge the entire Lambda proxy event by setting a single HTTP header. This weakness is classified as insufficient verification of data authenticity [CWE-345].

Critical Impact
An unauthenticated remote attacker can forge the Lambda proxy event, override the authorizer context, and achieve full authentication bypass and privilege escalation.

Affected Products

@fastify/aws-lambda version 6.4.0
Fastify applications deployed on AWS Lambda that rely on request.awsLambda.event for authorization
Applications reading API Gateway authorizer claims through the decoration

Discovery Timeline

2026-08-03 - CVE-2026-18248 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18248

Vulnerability Analysis

The @fastify/aws-lambda adapter translates AWS Lambda proxy events into Fastify requests. Version 6.4.0 exposes the Lambda event and context on the request object so downstream handlers can consume authorizer output, request identity, and routing metadata. The decoration getter inspects incoming HTTP headers x-apigateway-event and x-apigateway-context and, if present, uses their JSON-decoded values as the event and context. The intended trusted source, an internal per-invocation token, is only consulted as a fallback. Because the reserved headers are not stripped before request processing, any client can supply them. Applications that treat request.awsLambda.event.requestContext.authorizer as authoritative identity input will accept attacker-controlled claims.

Root Cause

The root cause is a trust boundary violation. The library assigns higher precedence to unauthenticated, client-supplied headers than to the internal invocation token, and it fails to sanitize reserved headers on ingress. This produces spoofable authorizer data.

Attack Vector

Exploitation requires only network access to the Lambda-fronted HTTP endpoint. An unauthenticated attacker submits a request containing a crafted x-apigateway-event header with a JSON payload that includes a forged requestContext.authorizer object. The application reads the spoofed claims and grants elevated privileges. No user interaction, prior authentication, or special tooling is required. See the GitHub Security Advisory GHSA-m93c-jj3f-68ph for the vendor description.

Detection Methods for CVE-2026-18248

Indicators of Compromise

Incoming HTTP requests containing the x-apigateway-event or x-apigateway-context headers from external clients
Access log entries showing successful authorization to privileged routes without a corresponding API Gateway authorizer invocation
Discrepancies between CloudWatch API Gateway authorizer logs and application-level identity logs

Detection Strategies

Inspect ingress logs and WAF telemetry for the reserved headers x-apigateway-event and x-apigateway-context on any request that reaches the Lambda origin.
Correlate authorizer claims recorded by the application with API Gateway authorizer results to identify forged identities.
Audit deployed Lambda functions for the presence of @fastify/aws-lambda at version 6.4.0 using software bill of materials or package lockfiles.

Monitoring Recommendations

Forward API Gateway, Lambda, and application logs into a centralized data lake and alert on requests carrying reserved AWS proxy headers.
Track privilege-sensitive route usage and flag sessions where authorizer identity claims lack matching upstream authorizer events.
Add continuous dependency scanning to CI/CD to detect the vulnerable package version before deployment.

How to Mitigate CVE-2026-18248

Immediate Actions Required

Upgrade @fastify/aws-lambda from 6.4.0 to 6.4.1 in all affected functions and redeploy.
Deploy an ingress rule at API Gateway, CloudFront, or WAF to strip or reject the x-apigateway-event and x-apigateway-context headers on inbound requests.
Rotate any session tokens or credentials that may have been issued based on forged authorizer claims during the exposure window.

Patch Information

The maintainers released @fastify/aws-lambda6.4.1. The patch resolves the decoration only through the internal per-invocation token and strips the reserved headers before the request is processed. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-m93c-jj3f-68ph for full details.

Workarounds

If patching is not immediately possible, configure API Gateway or WAF to drop the x-apigateway-event and x-apigateway-context headers before requests reach Lambda.
Refactor handlers to source identity exclusively from a server-controlled context object rather than from request.awsLambda.event until the upgrade is complete.

bash

# Upgrade the vulnerable dependency
npm install @fastify/aws-lambda@6.4.1

# Verify the installed version
npm ls @fastify/aws-lambda