aws-cdk-lib-2.260.0.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - aws-cdk-lib-2.260.0.tgz

Path to dependency file: /tiles-generation/cdk/package.json

Path to vulnerable library: /tiles-generation/cdk/node_modules/aws-cdk-lib/node_modules/brace-expansion/package.json

Found in HEAD commit: d4eedfee5988a29d020dcf10a934c7586625d113

CVE-2026-13676

Vulnerable Library - fast-uri-3.1.2.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz

Path to dependency file: /tiles-generation/cdk/package.json

Path to vulnerable library: /tiles-generation/cdk/node_modules/aws-cdk-lib/node_modules/fast-uri/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.260.0.tgz (Root Library)
  • table-6.9.0.tgz
    • ajv-8.20.0.tgz
      • ❌ fast-uri-3.1.2.tgz (Vulnerable Library)

Found in HEAD commit: d4eedfee5988a29d020dcf10a934c7586625d113

Found in base branch: main

Vulnerability Details

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

Publish Date: 2026-06-29

URL: CVE-2026-13676

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6

Release Date: 2026-06-29

Fix Resolution: fast-uri - 3.1.3,fast-uri - 4.0.1

CVE-2026-13149

Vulnerable Library - brace-expansion-5.0.6.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz

Path to dependency file: /tiles-generation/cdk/package.json

Path to vulnerable library: /tiles-generation/cdk/node_modules/aws-cdk-lib/node_modules/brace-expansion/package.json

Dependency Hierarchy:

• aws-cdk-lib-2.260.0.tgz (Root Library)
  • minimatch-10.2.5.tgz
    • ❌ brace-expansion-5.0.6.tgz (Vulnerable Library)

Found in HEAD commit: d4eedfee5988a29d020dcf10a934c7586625d113

Found in base branch: main

Vulnerability Details

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Publish Date: 2026-06-30

URL: CVE-2026-13149

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-30

Fix Resolution: brace-expansion - 5.0.7,https://github.com/juliangruber/brace-expansion.git - v5.0.7