- Security: fixed Lambda event spoofing via the client-controlled
x-apigateway-eventheader (CVE-2026-18248). Affects 6.4.0 only — upgrade immediately if you rely onrequest.awsLambda.eventfor authorization.
x-apigateway-event header (CVE-2026-18248). Affects 6.4.0 only — upgrade immediately if you rely on request.awsLambda.event for authorization.