Executive brief
AWS SDK for JavaScript is used by developers to call Amazon Web Services APIs from JavaScript applications. The region parameter, if set to an invalid value by an attacker with environment access, could cause API calls to be routed to non-AWS hosts, potentially exposing credentials or sensitive data. AWS has implemented validation safeguards in the SDK to prevent misrouting of API calls.
Technical details
The vulnerability relates to improper validation of the region parameter used to construct AWS API endpoint URLs. An actor with access to the application environment could set the region input field to an invalid value, bypassing normal endpoint validation. The root cause is insufficient input validation in the SDK's configuration resolution logic. AWS SDK for JavaScript v3 versions 3.723.0 and later, and @smithy/config-resolver v4.4.0 and later, implement validation that enforces the region must be a valid host label. AWS SDK for JavaScript v2 (end-of-support as of September 8, 2025) has no patch; users should migrate to v3. The attack requires environment access to modify configuration but no network-level privileges.
Affected products
- AWS SDK for JavaScript v3 <3.723.0
- AWS SDK for JavaScript v2 all versions
- AWS @smithy/config-resolver <4.4.0
Timeline
- 2026-01-08: disclosed: GHSA-6475-r3vj-m8vf published
- 2025-11-15: patched: AWS SDK for JavaScript v3 versions 3.723.0+ and @smithy/config-resolver v4.4.0+ released with validation enhancement