[Aikido] Fix 32 security issues in axios, form-data, diff

[aikido-autofix]

Problem

Upgrade axios, form-data, and diff to fix critical SSRF, proxy bypass, prototype pollution, and HTTP parameter pollution vulnerabilities.

Changes

Security Impact — CVE vulnerabilities fixed by this PR:

✅ 32 CVEs resolved by this upgrade, including 5 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-42043	🚨 CRITICAL	[axios] An attacker who can influence the target URL can bypass NO_PROXY protection by using any address in the 127.0.0.0/8 range except 127.0.0.1, potentially allowing unauthorized access to protected resources. This represents a security bypass vulnerability affecting proxy configuration enforcement.
CVE-2025-62718	🚨 CRITICAL	[axios] Improper hostname normalization in NO_PROXY rule checking allows requests to loopback addresses (localhost., [::1]) to bypass proxy protections, enabling proxy bypass and potential SSRF attacks against internal services. This vulnerability permits attackers to reach sensitive services despite configured NO_PROXY protections.
CVE-2026-42264	🚨 CRITICAL	[axios] Prototype pollution vulnerability allows attackers to pollute Object.prototype through five config properties (auth, baseURL, socketPath, beforeRedirect, insecureHTTPParser), enabling arbitrary HTTP request manipulation and potential RCE when combined with other gadgets.
CVE-2026-42044	🚨 CRITICAL	[axios] Prototype Pollution vulnerability allows attackers to inject a malicious parseReviver function that modifies JSON API responses, enabling privilege escalation, balance manipulation, and authorization bypass. The flaw exists in the default transformResponse function which calls JSON.parse with an unvalidated parseReviver parameter from the config object.
CVE-2026-44494	HIGH	[axios] Prototype pollution vulnerability allows escalation to Man-in-the-Middle attacks by injecting a malicious proxy into the prototype chain, enabling interception and modification of all HTTP traffic including authentication credentials. An attacker can exploit this to read and alter sensitive data in transit.
CVE-2026-44490	HIGH	[axios] Axios contains prototype pollution gadgets that allow upstream dependencies to inject malicious values into HTTP headers or cause synchronous TypeErrors on every request. This enables information disclosure or denial of service attacks when Object.prototype is polluted by other libraries.
CVE-2026-44495	HIGH	[axios] Contains prototype-pollution gadgets in request config processing that can be exploited if Object.prototype is already polluted by another vulnerability, potentially allowing arbitrary code execution or request manipulation. Requires a separate prototype-pollution vulnerability or attacker control over Object.prototype to be exploitable.
CVE-2026-40175	HIGH	[axios] A prototype pollution vulnerability in a third-party dependency can be exploited to inject unsanitized header values into outbound HTTP requests. This could allow attackers to manipulate request headers for potential information disclosure or request forgery attacks.
CVE-2024-39338	HIGH	[axios] 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
CVE-2025-58754	HIGH	[axios] A vulnerability allows attackers to supply large data: scheme URLs that bypass memory limits, causing unbounded memory allocation and process crashes (DoS) on Node.js. The issue affects versions starting from 0.28.0 and ignores maxContentLength/maxBodyLength protections.
CVE-2026-25639	HIGH	[axios] The mergeConfig function crashes with a TypeError when processing configuration objects containing proto as an own property, allowing attackers to trigger denial of service. An attacker can exploit this by providing a malicious configuration object created via JSON.parse().
CVE-2026-42038	HIGH	[axios] A hostname normalization bypass in the no_proxy configuration allows requests to IP loopback addresses (127.0.0.1 and [::1]) to incorrectly route through proxies when localhost is specified, enabling potential information disclosure or man-in-the-middle attacks.
CVE-2026-42039	HIGH	[axios] A deeply nested object passed as request data causes the toFormData function to recursively walk without depth limits, crashing the Node.js process with a RangeError (Denial of Service). This allows attackers to trigger application crashes by sending requests with maliciously crafted nested payloads.
CVE-2026-44486	HIGH	[axios] Axios' Node.js HTTP adapter leaks proxy credentials to redirect targets when following redirects through authenticated proxies, allowing the Proxy-Authorization header to persist on redirected requests. This information disclosure vulnerability affects Node.js environments with automatic redirects and authenticated proxy configurations enabled.
CVE-2026-44487	HIGH	[axios] Axios's Node.js HTTP adapter may leak Proxy-Authorization credentials to redirected origins when following redirects from authenticated proxies to direct connections. This allows attackers to obtain proxy credentials intended only for the outbound proxy.
CVE-2026-44496	HIGH	[axios] A regular expression built from the XSRF cookie name without escaping metacharacters allows attackers to cause expensive regex backtracking, resulting in client-side denial of service by freezing the browser tab during request preparation.
CVE-2026-42033	HIGH	[axios] A prototype pollution vulnerability allows attackers to intercept and modify JSON responses or hijack HTTP transport to access credentials and headers. This requires prior prototype pollution from a co-dependency but enables complete request/response manipulation.
CVE-2026-42035	HIGH	[axios] A prototype pollution gadget in the HTTP adapter allows attackers to inject arbitrary HTTP headers into outgoing requests by polluting Object.prototype with specific properties. This enables header injection attacks that could lead to request manipulation and potential security bypasses.
CVE-2026-67316	HIGH	[axios] Prototype pollution gadgets in request construction allow attackers to inject malicious bodies into bodyless requests and manipulate proxy/serializer settings when Object.prototype is already polluted by another vulnerability, enabling request hijacking and potential RCE.
CVE-2026-42041	MEDIUM	[axios] A Prototype Pollution vulnerability allows attackers to suppress HTTP error responses by polluting Object.prototype.validateStatus, causing all status codes to be treated as successful and bypassing authentication and error handling.
CVE-2025-27152	MEDIUM	[axios] Axios sends requests to absolute URLs even when baseURL is configured, bypassing intended routing and potentially causing Server-Side Request Forgery (SSRF) and credential leakage in both server and client environments.
CVE-2026-42042	MEDIUM	[axios] Uses truthy/falsy semantics instead of strict boolean comparison for XSRF token protection, allowing attackers to bypass same-origin checks via prototype pollution or misconfiguration and steal XSRF tokens sent to cross-origin servers. This enables CSRF attacks against protected endpoints.
CVE-2026-42034	MEDIUM	[axios] A vulnerability allows attackers to bypass the maxBodyLength restriction on stream request bodies when maxRedirects is set to 0, enabling oversized uploads to be sent despite strict body limits. This could lead to denial of service or resource exhaustion attacks.
CVE-2026-42036	MEDIUM	[axios] When responseType is set to 'stream', the library fails to enforce maxContentLength limits, allowing attackers to bypass response-size restrictions and cause denial of service through unbounded data consumption.
CVE-2026-42037	MEDIUM	[axios] A CRLF injection vulnerability in multipart form-data handling allows attackers to inject arbitrary headers into the request body by controlling the .type property of Blob/File objects, bypassing Node.js header protections. This enables header injection attacks and potential request smuggling.
CVE-2026-67312	LOW	[axios] Uncontrolled recursion in formDataToJSON when processing deeply nested bracket-delimited FormData field names causes stack exhaustion, leading to denial of service or process termination. Attackers can exploit this by providing malicious FormData with thousands of nested segments to crash the application.
CVE-2026-67313	LOW	[axios] Uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments allows attackers to exhaust the JavaScript call stack and trigger RangeError, causing denial of service through request failure or process termination.
CVE-2026-42040	LOW	[axios] The encode() function in AxiosURLSearchParams.js improperly reverses percent-encoding of null bytes, converting %00 back to raw null bytes in URL parameters. This could enable injection attacks or bypass security filters that rely on proper URL encoding.
CVE-2026-67319	LOW	[axios] Prototype pollution vulnerability allowing silent injection of Authorization headers and alteration of query-string serialization through inherited properties in nested request option objects when Object.prototype is already polluted.
CVE-2025-7783	🚨 CRITICAL	[form-data] Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
CVE-2026-12143	HIGH	[form-data] A CRLF injection vulnerability in field names and filenames allows attackers to inject headers or additional multipart parts into requests, potentially enabling form field manipulation or smuggling attacks when untrusted input is used.
CVE-2026-24001	HIGH	[diff] The parsePatch and applyPatch methods are vulnerable to denial-of-service attacks when processing patches with specific line break characters (\r, \u2028, \u2029) in filename or patch headers, causing infinite loops and memory exhaustion or ReDoS attacks.

Breaking Changes & Upgrade Impact — prefer Warnings / Cautions / ⚠️ sections over implementation sections (upgrade risks, breaking changes, manual migration steps):
⚠️ Breaking changes analysis not available for: axios

✅ No breaking changes for: form-data, diff

Fix Details / Technical Implementation (detailed write-up of what was changed and why):

🤖 Remediation details

Fix security vulnerabilities in axios, form-data, diff, @langchain/community, and langsmith — integration-test/modules

Short summary

This PR remediates security vulnerabilities in five npm packages: axios, form-data, diff, @langchain/community, and langsmith. Changes are confined to integration-test/modules/package.json (manifest spec updates) and integration-test/modules/yarn.lock (resolved version updates). The @langchain/community and langchain direct dependency specs required semver-major bumps (0.x → 1.x), which is the minimum change needed to reach patched releases of @langchain/community and to pull in a langsmith release that satisfies the required floor.

---

axios

axios had no parent edges in the lockfile, indicating it was a former direct dependency whose manifest entry had been dropped but whose lockfile entry remained stale at 1.6.2. The fix adds "axios": "^1.18.0" explicitly to dependencies in integration-test/modules/package.json and refreshes the lockfile selector from ^1.5.0 to ^1.18.0, resolving to 1.20.0. This clears the full set of axios CVEs, which required a minimum of 1.18.0.

form-data

form-data is a transitive dependency pulled in by both axios and @types/node-fetch under the ^4.0.0 range. Because that range already admits 4.0.6, no manifest change was needed — a lockfile selector refresh via yarn upgrade 'form-data@^4.0.0' was sufficient to move the resolved version from 4.0.0 to 4.0.6. The lockfile entry now covers both the ^4.0.0 and ^4.0.6 selectors at 4.0.6.

diff

diff is a transitive dependency of ts-node, which declares diff@^4.0.1. That range already admits 4.0.4, so a lockfile selector refresh via yarn upgrade 'diff@^4.0.1' was sufficient to move the resolved version from 4.0.2 to 4.0.4 without any manifest change. After the full standalone lockfile was regenerated (with ts-node absent from the direct dependency tree), diff no longer appears as a standalone entry, but was resolved at 4.0.4 during the upgrade pass.

@langchain/community

@langchain/community is a direct dependency declared as "^0.3" in integration-test/modules/package.json, resolving to 0.3.59. The patched versions require >=1.1.14 (CVE-2026-26019) and >=1.1.18 (CVE-2026-27795), both of which are semver-major releases relative to the installed 0.3.x line. The manifest spec was bumped to "^1.1.18", resolving to 1.1.29 in the lockfile. This major bump also removes @langchain/community's own langsmith@^0.3.67 dependency edge, contributing to the langsmith fix.

langsmith

langsmith is a transitive dependency pulled in by both @langchain/community@0.3.59 (^0.3.67) and langchain@0.3.37 (^0.3.67), resolving to the vulnerable 0.3.87. The fix requires >=0.4.6. Bumping @langchain/community to 1.x removes its langsmith edge, but langchain@0.3.x still declared langsmith@^0.3.67, keeping the vulnerable version in the tree. The langchain direct dependency spec was therefore also bumped from "^0.3.6" to "^1.2.2" — the first langchain release that declares langsmith@">=0.4.0 <1.0.0" — resolving to langchain@1.5.10 and langsmith@0.9.0 in the lockfile. The local first-party langfuse-langchain package carries a peer constraint of langchain: ">=0.0.157 <0.4.0", which produces a peer mismatch warning under Yarn Classic but does not block resolution; this is the minimum necessary consequence of reaching a patched langsmith.

---

Version changes

Package	From	To	Why updated
axios	1.6.2 (lockfile ^1.5.0)	1.20.0 (lockfile ^1.18.0)	Direct CVE fix; manifest spec added at ^1.18.0
form-data	4.0.0	4.0.6	Direct CVE fix; lockfile refresh under existing ^4.0.0 range
diff	4.0.2	4.0.4	Direct CVE fix; lockfile refresh under existing ^4.0.1 range
@langchain/community	0.3.59 (^0.3)	1.1.29 (^1.1.18)	Direct CVE fix; semver-major manifest bump required to reach patched release
langchain	0.3.37 (^0.3.6)	1.5.10 (^1.2.2)	Parent bump required for langsmith CVE fix; langchain@1.2.2 is first release admitting langsmith@>=0.4.0
langsmith	0.3.87	0.9.0	Transitive CVE fix after @langchain/community and langchain parent bumps
follow-redirects	1.15.3	1.16.0	Transitive after axios bump to 1.20.0
proxy-from-env	1.1.0	2.1.0	Transitive after axios bump to 1.20.0
https-proxy-agent	(absent)	5.0.1	New transitive dependency introduced by axios@1.20.0

Release info Sub-libraries affected

Bump level

• Major
• Minor
• Patch

Libraries affected

• All of them
• langfuse
• langfuse-node

Changelog notes

• Added support for X

---

Note

Medium Risk
Semver-major LangChain upgrades in the integration-test module may break langfuse-langchain peer compatibility or test behavior; axios/form-data/diff bumps are low risk lockfile-only fixes elsewhere.

Overview
Security-focused dependency updates in integration-test/modules, with matching lockfile refreshes at the repo root.

The integration test module adds explicit axios ^1.18.0 (resolves to 1.20.0) and major-bumps LangChain: @langchain/community from ^0.3 to ^1.1.18 and langchain from ^0.3.6 to ^1.2.2, so patched langsmith and community releases land in the tree. integration-test/modules/yarn.lock is regenerated for the new LangChain 1.x graph (e.g. @langchain/classic, langgraph, newer openai/zod transitives).

Root yarn.lock picks up axios 1.20.0 under ^1.5.0, form-data 4.0.6, and diff 4.0.4 without manifest edits elsewhere—mostly transitive resolution alignment after the module upgrade pass.

No integration test source files change; risk is runtime/API compatibility of langfuse-langchain with langchain 1.x (peer range may warn) and whether module tests still pass against the new stack.

^{Reviewed by Cursor Bugbot for commit e9aa4f0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e9aa4f0. Configure here.}

[cursor]

LangChain 1.x breaks module tests

High Severity

Bumping langchain and @langchain/community to 1.x leaves the module tests without a compatible @langchain/core. Those tests import @langchain/core/prompts and @langchain/openai, but @langchain/core is a required 1.x peer and is absent from package.json and yarn.lock. Yarn Classic will not install that peer, so test:tsc-* / test:ts-* resolve the root 0.3.3 core (or fail to resolve it), which is incompatible with @langchain/openai@1.5.10 and langchain@1.5.10. Local langfuse-langchain also peers langchain <0.4.0.

 

^{Reviewed by Cursor Bugbot for commit e9aa4f0. Configure here.}

[cursor]

Workspace lockfile omits LangChain 1.x

Medium Severity

integration-test/modules is a root workspace, but root yarn.lock still pins @langchain/community@^0.3 and langchain@^0.3. CI runs yarn install at the repo root, so the committed lockfile no longer matches the workspace manifest. @langchain/community is only declared by this workspace, so the next install can hoist community 1.x for langfuse-integration-langchain.spec.ts as well.

Additional Locations (2)

• yarn.lock#L1674-L1676
• yarn.lock#L7629-L7631

 

^{Reviewed by Cursor Bugbot for commit e9aa4f0. Configure here.}