aws-cdk-lib-2.254.0.tgz: 11 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - aws-cdk-lib-2.254.0.tgz

Version 2 of the AWS Cloud Development Kit library

Library home page: https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.254.0.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

CVE-2026-84292

Vulnerable Library - fast-uri-3.1.2.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • table-6.9.0.tgz
    • ajv-8.18.0.tgz
      • ❌ fast-uri-3.1.2.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.

Publish Date: 2026-09-02

URL: CVE-2026-84292

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3

Release Date: 2026-09-02

Fix Resolution (fast-uri): 3.1.7

Direct dependency fix Resolution (aws-cdk-lib): 2.261.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-76172

Vulnerable Library - fast-uri-3.1.2.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • table-6.9.0.tgz
    • ajv-8.18.0.tgz
      • ❌ fast-uri-3.1.2.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.

Publish Date: 2026-08-24

URL: CVE-2026-76172

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp

Release Date: 2026-08-24

Fix Resolution (fast-uri): 3.1.6

Direct dependency fix Resolution (aws-cdk-lib): 2.261.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-75975

Vulnerable Library - fast-uri-3.1.2.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • table-6.9.0.tgz
    • ajv-8.18.0.tgz
      • ❌ fast-uri-3.1.2.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.

Publish Date: 2026-08-24

URL: CVE-2026-75975

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc

Release Date: 2026-08-24

Fix Resolution (fast-uri): 3.1.6

Direct dependency fix Resolution (aws-cdk-lib): 2.261.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-75899

Vulnerable Library - fast-uri-3.1.2.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • table-6.9.0.tgz
    • ajv-8.18.0.tgz
      • ❌ fast-uri-3.1.2.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.

Publish Date: 2026-08-24

URL: CVE-2026-75899

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf

Release Date: 2026-08-24

Fix Resolution (fast-uri): 3.1.6

Direct dependency fix Resolution (aws-cdk-lib): 2.261.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-69152

Vulnerable Library - brace-expansion-5.0.6.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • minimatch-10.2.5.tgz
    • ❌ brace-expansion-5.0.6.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

Publish Date: 2026-08-03

URL: CVE-2026-69152

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-03

Fix Resolution: https://github.com/juliangruber/brace-expansion.git - v2.1.4,https://github.com/juliangruber/brace-expansion.git - v5.0.9,https://github.com/juliangruber/brace-expansion.git - v1.1.18,https://github.com/juliangruber/brace-expansion.git - v3.0.6

CVE-2026-18446

Vulnerable Library - fast-uri-3.1.2.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • table-6.9.0.tgz
    • ajv-8.18.0.tgz
      • ❌ fast-uri-3.1.2.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.

Publish Date: 2026-07-31

URL: CVE-2026-18446

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7

Release Date: 2026-07-31

Fix Resolution (fast-uri): 3.1.5

Direct dependency fix Resolution (aws-cdk-lib): 2.261.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-16221

Vulnerable Library - fast-uri-3.1.2.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • table-6.9.0.tgz
    • ajv-8.18.0.tgz
      • ❌ fast-uri-3.1.2.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.
Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.
Workarounds: none.

Publish Date: 2026-07-19

URL: CVE-2026-16221

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx

Release Date: 2026-07-19

Fix Resolution (fast-uri): 3.1.4

Direct dependency fix Resolution (aws-cdk-lib): 2.261.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-14257

Vulnerable Library - brace-expansion-5.0.6.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • minimatch-10.2.5.tgz
    • ❌ brace-expansion-5.0.6.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Publish Date: 2026-07-23

URL: CVE-2026-14257

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-23

Fix Resolution: https://github.com/juliangruber/brace-expansion.git - v3.0.3,https://github.com/juliangruber/brace-expansion.git - v5.0.8,https://github.com/juliangruber/brace-expansion.git - v2.1.3,https://github.com/juliangruber/brace-expansion.git - v1.1.17

CVE-2026-13676

Vulnerable Library - fast-uri-3.1.2.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • table-6.9.0.tgz
    • ajv-8.18.0.tgz
      • ❌ fast-uri-3.1.2.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

Publish Date: 2026-06-29

URL: CVE-2026-13676

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6

Release Date: 2026-06-29

Fix Resolution (fast-uri): 3.1.3

Direct dependency fix Resolution (aws-cdk-lib): 2.255.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-13149

Vulnerable Library - brace-expansion-5.0.6.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json,/release/staging-resources-cdk/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.254.0.tgz (Root Library)
  • minimatch-10.2.5.tgz
    • ❌ brace-expansion-5.0.6.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Publish Date: 2026-06-30

URL: CVE-2026-13149

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-30

Fix Resolution: https://github.com/juliangruber/brace-expansion.git - v5.0.7

CVE-2026-13760

Vulnerable Library - aws-cdk-lib-2.254.0.tgz

Version 2 of the AWS Cloud Development Kit library

Library home page: https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.254.0.tgz

Sample Path to Dependency File: /testing/aws-testing-cdk/package.json

Path to vulnerable library: /testing/aws-testing-cdk/package.json

Dependency Hierarchy:

• ❌ aws-cdk-lib-2.254.0.tgz (Vulnerable Library)

Found in HEAD commit: eaca0240768d03d4229f0aa93390488d93c04480

Found in base branch: main

Vulnerability Details

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified.
To remediate this issue, users should upgrade to v2.260.0.

Publish Date: 2026-07-01

URL: CVE-2026-13760

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://github.com/aws/aws-cdk/security/advisories/GHSA-vcrf-j523-4mrf

Release Date: 2026-07-01

Fix Resolution: 2.260.0

⛑️ Automatic Remediation will be attempted for this issue.