Skip to content

[Aikido] Fix security issue in fast-uri via minor version upgrade from 3.1.0 to 3.1.2 in apps#2

Open
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-33666341-4xbu
Open

[Aikido] Fix security issue in fast-uri via minor version upgrade from 3.1.0 to 3.1.2 in apps#2
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-33666341-4xbu

Conversation

@aikido-autofix
Copy link
Copy Markdown

Upgrade fast-uri to fix path traversal and authority spoofing vulnerabilities where improper percent-encoding handling allows policy bypass and host redirection attacks.

✅ 3 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-6321
HIGH
[fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs.
CVE-2026-6322
HIGH
[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-10784
HIGH
[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants