Skip to content

[Aikido] Fix security issue in fast-uri via minor version upgrade from 3.1.0 to 3.1.3 in example - #269

Merged
evan-boone merged 2 commits into
masterfrom
fix/aikido-security-update-packages-70935710-hnus
Jul 21, 2026
Merged

[Aikido] Fix security issue in fast-uri via minor version upgrade from 3.1.0 to 3.1.3 in example#269
evan-boone merged 2 commits into
masterfrom
fix/aikido-security-update-packages-70935710-hnus

Conversation

@aikido-autofix

Copy link
Copy Markdown
Contributor

Upgrade fast-uri to fix path traversal, authority spoofing, and host canonicalization vulnerabilities in normalize() and equal() functions.

✅ 4 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-6321
HIGH
[fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs.
CVE-2026-6322
HIGH
[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-10784
HIGH
[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.
AIKIDO-2026-507986
HIGH
[fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization.

aikido-autofix Bot and others added 2 commits July 21, 2026 09:53
…example

The prior fast-uri lockfile-only patch left bun.lock out of sync with
package.json, breaking the frozen-lockfile install in CI. Bumping
aws-cdk-lib drops the table/ajv/fast-uri chain entirely, so the
vulnerable transitive dependency is gone without needing an override.
aws-cdk CLI is bumped alongside it since 2.261.0 emits a cloud assembly
schema newer than older CLI versions can read.
@evan-boone
evan-boone merged commit 86c1b4f into master Jul 21, 2026
2 checks passed
@evan-boone
evan-boone deleted the fix/aikido-security-update-packages-70935710-hnus branch July 21, 2026 10:51
@github-actions

Copy link
Copy Markdown
Contributor

🎉 This PR is included in version 1.10.12 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant