A critical authentication bypass in @fastify/aws-lambda allows attackers to forge request context, granting unauthorized access to protected application functions.

The application incorrectly trusts client-controlled HTTP headers to populate request context, failing to strip reserved headers before processing. This permits an unauthenticated attacker to override identity claims, resulting in a full authorization bypass.

Successful exploitation allows an attacker to escalate privileges and perform actions as an authorized user, potentially leading to unauthorized data access or administrative control. With a CVSS score of 9.1, this represents a severe risk to any application relying on the library for identity management or access control.

Immediate Action: Upgrade the @fastify/aws-lambda package to version 6.4.1 or later to resolve the header processing flaw.

Proactive Monitoring: Review application logs for unusual request headers or attempts to inject unexpected values into API Gateway context fields.

Compensating Controls: Implement strict input validation at the API Gateway level to strip reserved headers before they reach the backend Lambda function.

Public Exploit Available: Unknown

This vulnerability is a critical security flaw that directly impacts the integrity of authentication workflows. All developers using @fastify/aws-lambda version 6.4.0 should update to 6.4.1 immediately to prevent unauthorized privilege escalation.