CVE-2025-23206
1 advisory.
npm/aws-cdk-lib CVE-2025-23206: high 8.1, EPSS 0.33%
AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider
Action: Upgrade aws-cdk-lib to 2.177.0 or later.
npm i aws-cdk-lib@2.177.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.177.0 | - |
Fixed versions
| 2.177.0 |
Sources
- osv: GHSA-v4mq-x674-ff73
- nvd: CVE-2025-23206
- https://github.com/aws/aws-cdk/security/advisories/GHSA-v4mq-x674-ff73
- https://github.com/aws/aws-cdk/issues/32920
- https://github.com/aws/aws-cdk/pull/32921
- https://github.com/aws/aws-cdk/commit/3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9acaa5569cce7005a77560
- https://docs.aws.amazon.com/cdk/v2/guide/featureflags.html
- https://github.com/aws/aws-cdk
- https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34
- https://github.com/aws/aws-cdk/releases/tag/v2.177.0
CVE-2025-23206 · published · modified · JSON