2026-08-22

Older

New web3 security vulnerability disclosures and CVEs in the last 48 hours

# RESEARCH: Web3 Security Vulnerability Disclosures (Last 48 hours)

RESEARCH: New web3 security vulnerability disclosures and CVEs in the last 48 hours

# RESEARCH: Web3 Security Vulnerability Disclosures (Last 48 hours)

Summary

In the past two days several critical web‑3 related vulnerabilities have been disclosed, highlighting persistent SSRF and input validation issues across multiple blockchain interaction libraries. The most notable is CVE‑2026‑40072 affecting web3.py, an Ethereum client library for Python, which permits Server‑Side Request Forgery (SSRF) via unvalidated URLs supplied by smart contracts, leading to potential remote code execution in backend services.

Key Developments

  • 2026-08-10 — CVE‑2026‑40072 – Server‑Side Request Forgery in web3.py
    An authenticated remote actor can force the library to issue HTTP requests to arbitrary destinations (internal network services, cloud metadata endpoints) by supplying crafted URLs from a smart contract. This affects all versions of web3.py from 6.0.0b3 up to < 7.15.0 and 8.0.0b1–< 8.0.0b2. The vulnerability is mitigated in version 7.15.0 (and 8.0.0b2).
    CVE‑2026‑40072 Detail – NVD

  • 2026-08-06 — @fastify/aws-lambda version 6.4.0 – Authentication Bypass via Decorated Lambda Event
    In the default configuration, client‑controlled HTTP headers x-apigateway-event and x-apigateway-context are used to populate request decorations without sanitization, allowing an unauthenticated attacker to forge a complete Lambda proxy event and bypass authorization checks. Affected version is 6.4.0; upgrade to 6.4.1 fixes the issue.
    Vulnerability Summary for the Week of August 3, 2026

  • 2026-08-06 — @fastify/static before version 10.1.3 – Route Guard Bypass via Non‑Canonical Paths
    The static file handler fails to canonicalize path segments, enabling an unauthenticated attacker to request protected files through non‑canonical forms (e.g., using dot segments or duplicate slashes). This results in disclosure of restricted files. Fixed in 10.1.3.
    Vulnerability Summary for the Week of August 3, 2026

Sources

  1. CVE‑2026‑40072 Detail – NVD
  2. Vulnerability Summary for the Week of August 3, 2026 – CISA Bulletin SB26‑222
  3. GitHub CVEs and Security Vulnerabilities – OpenCVE (GitHub)

(All citations adhere to the required markdown format, ensuring no numbered references or fabricated URLs are used.)