aws-cdk-lib (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package aws-cdk-lib, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2025-23206 — CVSS 8.1 (high): The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and…
• CVE-2026-11417 — CVSS 7.3 (high): OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor…
• CVE-2023-35165 — CVSS 6.6 (medium): AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision…