Executive brief
The AWS SDK for JavaScript v2 does not properly validate the region parameter, which could allow an attacker with environment access to redirect API calls to unintended hosts. This could result in API calls being routed away from legitimate AWS services, potentially exposing application behavior or data. AWS recommends migrating to SDK v3, which includes enhanced validation, as v2 reached end-of-support in September 2025.
Technical details
This vulnerability stems from insufficient input validation on the region parameter in AWS SDK for JavaScript v2. An attacker with access to the application's environment (e.g., environment variables, configuration files) can set the region to an arbitrary invalid value, causing AWS API calls to be improperly routed to non-existent or non-AWS hosts. The attack requires environment-level access but no authentication or user interaction. The SDK itself functions as designed; the issue represents a defense-in-depth gap. AWS SDK for JavaScript v3 implements enhanced validation to mitigate this risk. No patch for v2 is available, as the product reached end-of-support on September 8, 2025.
Affected products
- AWS SDK for JavaScript 2.x (all versions)
Timeline
- 2026-01-08: disclosed: GitHub Security Advisory GHSA-j965-2qgj-vjmq published
- 2025-09-08: other: AWS SDK for JavaScript v2 reached end-of-support