CVE-2026-84961 (CRITICAL): undici 7.29.0 in the preinstalled AWS SDK of nodejs base images
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 55/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- aws, docker, node.js
- 领域
- cloud, infrastructure, security
调研方向
Start by inspecting package.json in the published layers for the listed nodejs base-image tags, especially /var/runtime/node_modules/@aws-sdk/node_modules/undici and Node's bundled copy. Rebuild the affected images with undici at the stated fixed versions and verify that the published layers no longer contain the vulnerable copies, including the Node 24 runtime image.
由索引模型根据 Issue 内容生成。
描述
The Node.js Lambda base images ship undici 7.29.0 inside the preinstalled AWS SDK v3, at /var/runtime/node_modules/@aws-sdk/node_modules/undici. That version is affected by CVE-2026-84961 (CVSS 9.1), fixed upstream in undici 7.29.1, published 2026-09-04.
Verified by reading package.json from the published image layers of:
- public.ecr.aws/lambda/nodejs:24.2026.09.12.00 - undici 7.29.0
- public.ecr.aws/lambda/nodejs:24.2026.09.08.11 - undici 7.29.0
- public.ecr.aws/lambda/nodejs:22.2026.06.19.17 - undici 7.29.0
- public.ecr.aws/lambda/nodejs:26-preview - undici 7.29.0 in the SDK, and 8.10.0 in Node's own bundled copy, which is below the 8.10.2 fix
Both the 09-08 and 09-12 builds were produced after the fix was available.
Note this is separate from Node's own bundled undici: Node v24.20.0 bundles deps/undici 7.29.0 and Node v24.21.0 bundles 7.29.1, but no Lambda base image ships v24.21.0 yet. Both copies are flagged by scanners.
Impact: every image built FROM these bases inherits the finding, so enterprise scanners with a critical-severity gate block production promotion, even for functions that bundle their own SDK and never import the preinstalled one.
Request: rebuild the nodejs base images with an SDK carrying undici >= 7.29.1, and ideally ship a Node 24.21.0-based image so the runtime's own bundled copy is patched too.
- 主要语言
- 没有语言数据
- 星标
- 775
- 派生
- 117
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
aws/aws-lambda-base-images 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 67/100
aws/aws-lambda-base-images#784 ·
-
难度 2/5 1-3 小时 新手友好度 66/100
aws/aws-lambda-base-images#769 ·
-
难度 2/5 1-3 小时 新手友好度 65/100
aws/aws-lambda-base-images#729 ·
-
难度 2/5 1-3 小时 新手友好度 72/100
aws/aws-lambda-base-images#728 ·
-
难度 2/5 1-3 小时 新手友好度 68/100
aws/aws-lambda-base-images#726 ·
查看 aws/aws-lambda-base-images 的全部 Issue
相似的 Issue
-
Updating an `OidcIssuer` without `thumbprints` fails with "You must provide at least one thumbprint"未关闭Bug kind/bug pulumi/pulumi-pulumiservice R1 S1
难度 2/5 1-3 小时 新手友好度 83/100
pulumi/pulumi-pulumiservice#1370 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
Documentation Gemini - Enterprise Level of Effort - Low Priority - Low Scope - Blueprint Scope - Module
难度 2/5 1-3 小时 新手友好度 78/100
google/stellar-engine#401 ·
维护者通常 1 天内回复
-
ECS host-network user check misses UID 0 and root user/group forms可能已有人在做 @leela-padala 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
prowler-cloud/prowler#13281 ·
维护者通常 1 天内回复
-
RemoteFileSystem uploads all files when ignore patterns exclude every entry可能已有人在做 @devin-ai-integration 今天认领。 未关闭bug
难度 2/5 1-3 小时 新手友好度 86/100
维护者通常 1 天内回复