aws-cdk-lib vulnerabilities

Latest aws-cdk-lib CVEs

Newest publication first

1. CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib

   Published 2026-10-08

   Medium·CVSS 6.8 EPSS 0.14%

   Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to ver...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.