npm cdk vulnerabilities

Latest npm cdk CVEs

Newest publication first

1. CVE-2025-2598 AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

   Published 2025-03-21

   Medium·CVSS 5.7 EPSS 0.31%

   When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.