aws-cdk-lib: bundled @aws-cdk/asset-awscli-v1@2.2.282 dependant package vulnerabilities CVE-2026-59884, CVE-2026-59885, CVE-2026-59886

[twalker1998]

Describe the bug

aws-cdk-lib@2.261.0 bundles @aws-cdk/asset-awscli-v1@2.2.282 which uses pyasn1@0.6.3

Security scanning is flagging this against CVE-2026-59884, CVE-2026-59885, and CVE-2026-59886.

This is patched in pyasn1@0.6.4 which is included in @aws-cdk/asset-awscli-v1@2.2.289.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

n/a

Current Behavior

n/a

Reproduction Steps

Install aws-cdk-lib@2.261.0 and scan dependencies

Possible Solution

No response

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.261.0

AWS CDK CLI version

2.1118.0

Node.js Version

24

OS

MacOS

Language

TypeScript

Language Version

7.0.2

Other information

No response

[pahud]

Hi @twalker1998,

┌────────────────────────────────────────────────────────────┐
│ 🔴 Reported State                                          │
│ aws-cdk-lib@2.261.0 ships asset-awscli-v1@2.2.282 whose    │
│ layer.zip bundles pyasn1 0.6.3 (3 CVEs flagged)            │
└─────────────────────────────┬──────────────────────────────┘
                              │
                              ▼
┌────────────────────────────────────────────────────────────┐
│ 🔍 Root Cause                                              │
│ asset-awscli-v1 is pinned to exact 2.2.282 in aws-cdk-lib, │
│ so the patched 2.2.289+ can't resolve via lockfile refresh │
│ packages/aws-cdk-lib/package.json#L120                     │
└─────────────────────────────┬──────────────────────────────┘
                              │
                              ▼
┌────────────────────────────────────────────────────────────┐
│ 🟢 Suggested Fix                                           │
│ Bump the pin to @aws-cdk/asset-awscli-v1@2.2.289+; until   │
│ then use npm overrides / yarn resolutions as a workaround  │
└────────────────────────────────────────────────────────────┘

Thanks for the detailed report. I was able to confirm this against the published npm artifacts: @aws-cdk/asset-awscli-v1@2.2.282's lib/layer.zip bundles pyasn1-0.6.3, while 2.2.289 (and the current 2.2.290) bundle the patched pyasn1-0.6.4.

The reason a lockfile refresh doesn't pick this up is that aws-cdk-lib pins this dependency to an exact version (no ^ range), and that pin is still 2.2.282 on main:

aws-cdk/packages/aws-cdk-lib/package.json

Line 120 in db98909

"@aws-cdk/asset-awscli-v1": "2.2.282",

So a bump PR in aws-cdk-lib is needed, and the fix will ship in the next release after it merges.

In the meantime, you can force the patched asset package in your app today — the package's API is unchanged between these versions, only the bundled layer zip differs:

npm (package.json):

"overrides": { "@aws-cdk/asset-awscli-v1": "2.2.290" }

yarn:

"resolutions": { "@aws-cdk/asset-awscli-v1": "2.2.290" }

Worth noting: the flagged pyasn1 only actually runs if your app deploys the AWS CLI v1 Lambda layer (e.g., via aws-s3-deployment's BucketDeployment), so for many apps this is scanner noise at rest — but the upgrade is the right call either way.

If you'd like, a PR bumping the pinned version in packages/aws-cdk-lib/package.json would be a very welcome (and small) contribution!

Making this a p1.

[vishwakt]

@pahud could i please get a review on the linked PR? #38362

[kumsmrit]

@twalker1998 Thank you for raising the issue.

The fix PR: #38125 has been released in cdk v2.265.0
Please let us know if this resolves your issue.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.