Homebrew Formulae: localstack

localstack (deprecated)

Disable date: 2027-04-12

Install command:

brew install localstack

Fully functional local AWS cloud stack

License: Apache-2.0

Formula code: localstack.rb on GitHub

Bottle (binary package) installation support provided for:

Current versions:

stable

✅

2026.3.0

Revision: 2

Depends on:

certifi	2026.7.22	Mozilla CA bundle for Python
cryptography	50.0.0	Cryptographic recipes and primitives for Python
libyaml	0.2.5	YAML Parser
openssl@3	3.6.3	Cryptography and SSL/TLS Toolkit
python@3.14	3.14.7	Interpreted, interactive, object-oriented programming language

Depends on when building from source:

pkgconf	3.0.5	Package compiler and linker metadata toolkit
rust	1.97.1	Safe, concurrent, practical language

Known vulnerabilities in the current version:

GHSA-8633-g3ph-97rp (high)	Missing SSL certificate validation in localstack
GHSA-qccp-gfcp-xxvc (medium)	urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
GHSA-mf9v-mfxr-j63j (high)	urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
GHSA-65pc-fj4g-8rjx (medium)	Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() ...
GHSA-993g-76c3-p5m4 (medium)	PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file:...
GHSA-jq35-7prp-9v3f (medium)	PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
GHSA-fhv5-28vv-h8m8 (low)	PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
GHSA-w7vc-732c-9m39 (medium)	PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=fals...
GHSA-xgmm-8j9v-c9wx (high)	PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are...
PYSEC-2026-2132 (high)

Data from Homebrew/advisory-database. Run brew vulns localstack for a live check.

Analytics: