CVE-2026-84961 (CRITICAL): undici 7.29.0 in the preinstalled AWS SDK of nodejs base images

Aperta
  • Qualcosa non va?
#683 0 commenti 1 reazione 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
aws, docker, node.js
Ambito
cloud, infrastructure, security

Direzione di ricerca

Start by inspecting package.json in the published layers for the listed nodejs base-image tags, especially /var/runtime/node_modules/@aws-sdk/node_modules/undici and Node's bundled copy. Rebuild the affected images with undici at the stated fixed versions and verify that the published layers no longer contain the vulnerable copies, including the Node 24 runtime image.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

The Node.js Lambda base images ship undici 7.29.0 inside the preinstalled AWS SDK v3, at /var/runtime/node_modules/@aws-sdk/node_modules/undici. That version is affected by CVE-2026-84961 (CVSS 9.1), fixed upstream in undici 7.29.1, published 2026-09-04.

Verified by reading package.json from the published image layers of:

  • public.ecr.aws/lambda/nodejs:24.2026.09.12.00 - undici 7.29.0
  • public.ecr.aws/lambda/nodejs:24.2026.09.08.11 - undici 7.29.0
  • public.ecr.aws/lambda/nodejs:22.2026.06.19.17 - undici 7.29.0
  • public.ecr.aws/lambda/nodejs:26-preview - undici 7.29.0 in the SDK, and 8.10.0 in Node's own bundled copy, which is below the 8.10.2 fix

Both the 09-08 and 09-12 builds were produced after the fix was available.

Note this is separate from Node's own bundled undici: Node v24.20.0 bundles deps/undici 7.29.0 and Node v24.21.0 bundles 7.29.1, but no Lambda base image ships v24.21.0 yet. Both copies are flagged by scanners.

Impact: every image built FROM these bases inherits the finding, so enterprise scanners with a critical-severity gate block production promotion, even for functions that bundle their own SDK and never import the preinstalled one.

Request: rebuild the nodejs base images with an SDK carrying undici >= 7.29.1, and ideally ship a Node 24.21.0-based image so the runtime's own bundled copy is patched too.

Lingua principale
Nessun dato sulla lingua
Stelle
775
Fork
117
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aws/aws-lambda-base-images

Tutte le issue di aws/aws-lambda-base-images

Issue simili

Altre issue su Cloud

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.