GitHub Advisoryadvisory · npm

GHSA-59f3-7227-wmh4 @hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails

HIGH Published 2026-05-21 Modified 2026-05-21 Official page ↗
Ecosystem
npm
Packages
@hulumi/policies
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-693
Reviewed
2026-05-21

Affected packages

• npm @hulumi/policies: < 1.3.2 → fixed in 1.3.2

Description

Impact: @hulumi/policies versions before 1.3.2 used stack-wide evidence shortcuts in several Cloudflare and deployment-governance validators. Unrelated compliant-looking evidence could suppress violations for different zones, hostnames, origins, or repositories in the same stack. Patched in 1.3.2: validators now correlate evidence to the specific protected resource and include regression coverage for unrelated-evidence bypasses. Remediation: upgrade @hulumi/policies to 1.3.2 or later.

Related

Weakness · CWE (1)

  • CWE-693 Protection Mechanism Failure weakness

References