CVE-2026-84961 (HIGH): detected in Lambda Docker Images.

Aperta
  • Qualcosa non va?
#709 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
aws, docker, node.js
Ambito
cloud, infrastructure, security

Direzione di ricerca

Start by locating the build definitions for the listed Lambda Node.js images and checking how the undici dependency is supplied. Update the affected package from 7.29.0 to a fixed version, then rebuild or inspect the affected images to confirm the vulnerable version is no longer present.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

CVE Details

CVE ID Severity Affected Package Installed Version Fixed Version Date Published Date of Scan
CVE-2026-84961 HIGH undici 7.29.0 7.29.1, 8.10.2 2026-09-04T17:17:02.227Z 2026-09-30T10:18:20.696138078Z

Affected Docker Images

Image Name SHA
public.ecr.aws/lambda/nodejs:latest public.ecr.aws/lambda/nodejs@sha256:523ce8499e16c3bff599c94691e1c6a1405aac415c13b95b98dbb9dddd052b77
public.ecr.aws/lambda/nodejs:26-preview public.ecr.aws/lambda/nodejs@sha256:f5118e838e4efe4462b87cb77b1b255170952560a5766ad9c0d3f30016c57800
public.ecr.aws/lambda/nodejs:24 public.ecr.aws/lambda/nodejs@sha256:523ce8499e16c3bff599c94691e1c6a1405aac415c13b95b98dbb9dddd052b77
public.ecr.aws/lambda/nodejs:22 public.ecr.aws/lambda/nodejs@sha256:282bd7028e6d1f365a3a174751634c7a84e12ef8a466cdcf786c3f4d744e743a

Description

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.

Remediation Steps
  • Update the affected package undici from version 7.29.0 to 7.29.1, 8.10.2.
About this issue
  • This issue may not contain all the information about the CVE nor the images it affects.
  • This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
  • For more, visit Lambda Watchdog.
  • This issue was created automatically by Lambda Watchdog.
Lingua principale
Nessun dato sulla lingua
Stelle
775
Fork
117
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aws/aws-lambda-base-images

Tutte le issue di aws/aws-lambda-base-images

Issue simili

Altre issue su Cloud

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.