[Aikido] Fix 40 security issues in fast-uri, hono by aikido-autofix[bot] · Pull Request #10 · Percepta-Core/sharehtml

aikido-autofix · 2026-08-02T23:55:05Z

Upgrade fast-uri and hono to fix critical SSRF/host-bypass and path-traversal vulnerabilities caused by improper URI normalization and authority parsing.

⚠️ Breaking changes analysis not available for: hono

✅ No breaking changes for: fast-uri

✅ 40 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-878106	HIGH	[fast-uri] URI authority parsing fails to treat backslashes as delimiters, allowing different host interpretations compared to Node's WHATWG URL parser, enabling bypass of host allowlists, SSRF filters, and redirect validation checks. The vulnerability permits attackers to circumvent security controls through crafted URIs containing backslashes.
CVE-2026-6321	HIGH	[fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs.
CVE-2026-6322	HIGH	[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.
AIKIDO-2026-507986	HIGH	[fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization.
CVE-2026-13676	HIGH	[fast-uri] A vulnerability in IDN hostname canonicalization allows Unicode hostnames to bypass host-based security policies (denylists, loopback filtering, redirects) when fast-uri's output differs from standard URL parsers. This enables attackers to circumvent security controls that rely on host validation.
CVE-2026-16221	HIGH	[fast-uri] A parsing discrepancy in fast-uri allows backslash characters to bypass host-based security policies like allowlists and SSRF filters, enabling attackers to redirect requests to unintended destinations including internal hosts and cloud metadata endpoints.
AIKIDO-2026-236835	HIGH	[fast-uri] A parsing discrepancy allows attackers to bypass host allowlists and SSRF filters by using alternative authority introducers (backslashes, mixed slashes, whitespace) that `fast-uri` treats as paths but Node's URL parser treats as authority, enabling redirection to unintended destinations.
CVE-2026-39408	HIGH	[hono] Path traversal vulnerability in toSSG() allows attackers to write files outside the configured output directory during static site generation using specially crafted dynamic route parameters. This enables arbitrary file write attacks that could compromise system integrity.
AIKIDO-2026-11187	HIGH	[hono] CORS middleware with credentials enabled and wildcard origin incorrectly reflects the request Origin header instead of rejecting it, allowing any third-party page to make credentialed cross-origin requests and read cookie-authenticated API responses.
CVE-2026-54290	HIGH	[hono] CORS middleware with credentials enabled and default wildcard origin incorrectly reflects any request origin, allowing arbitrary sites to make credentialed cross-origin requests and access cookie-authenticated endpoints.
AIKIDO-2026-10704	MEDIUM	[hono] A body size limit middleware vulnerability allowed oversized payloads to bypass the limit check and reach application logic when `Content-Length` was missing or bodies were chunked, due to asynchronous limit enforcement. This could enable DoS attacks or unintended data processing despite configured size restrictions.
CVE-2026-47673	MEDIUM	[hono] JWT and JWK middlewares fail to verify the Authorization header uses the Bearer scheme, allowing authentication bypass when valid JWTs are presented with alternative scheme identifiers like Basic or Token.
AIKIDO-2026-571543	MEDIUM	[hono] The body-limit middleware on AWS Lambda adapters can be bypassed by declaring a small Content-Length header while sending a larger actual body, allowing oversized payloads to pass validation checks. This vulnerability enables denial-of-service attacks and potential remote code execution through request body processing.
CVE-2026-54288	MEDIUM	[hono] Body Limit Middleware improperly validates request size by trusting the Content-Length header instead of actual payload size, allowing attackers to bypass limits and send oversized bodies on AWS Lambda environments, potentially causing DoS or resource exhaustion.
CVE-2026-44455	MEDIUM	[hono] Improper handling of JSX element tag names allows unvalidated tag names to be inserted into HTML output during server-side rendering, enabling HTML injection attacks when untrusted input is used as tag names via jsx() or createElement() APIs.
AIKIDO-2026-11189	MEDIUM	[hono] A path traversal vulnerability in the serve-static middleware allows attackers to bypass authentication guards on Windows by using encoded backslashes in URLs to access protected static files. The vulnerability enables unauthenticated file disclosure without escaping the configured root directory.
CVE-2026-54286	MEDIUM	[hono] Path traversal vulnerability on Windows where encoded backslashes (%5C) in request paths are decoded and treated as separators, allowing attackers to bypass middleware protections and read arbitrary static files.
CVE-2026-39407	MEDIUM	[hono] Path handling inconsistency in serveStatic allows bypassing route-based authorization middleware by using repeated slashes (//) in request paths, enabling unauthorized access to protected static files.
CVE-2026-39409	MEDIUM	[hono] The ipRestriction() middleware fails to canonicalize IPv4-mapped IPv6 addresses before applying IPv4 allow/deny rules, allowing attackers to bypass IP-based access controls in dual-stack environments.
GHSA-26pp-8wgv-hjvm	MEDIUM	[hono] Cookie names are not validated in `setCookie()`, `serialize()`, or `serializeSigned()`, allowing invalid characters that can cause malformed Set-Cookie headers and runtime errors when processing untrusted cookie names.
AIKIDO-2026-10776	MEDIUM	[hono] Cache middleware improperly caches responses with varying Authorization or Cookie headers, allowing cached user-specific data to be served to different authenticated users, resulting in information disclosure.
CVE-2026-44457	MEDIUM	[hono] Cache Middleware fails to skip caching for responses with Vary: Authorization or Vary: Cookie headers, allowing cached responses from one authenticated user to be served to other users, resulting in information disclosure.
CVE-2026-47674	MEDIUM	[hono] The ip-restriction middleware fails to match non-canonical IPv6 representations against configured rules, allowing attackers to bypass IP-based access controls through alternative address formats.
CVE-2026-47675	MEDIUM	[hono] The serialize() function fails to validate sameSite and priority cookie options against characters that corrupt Set-Cookie headers, allowing attackers to inject arbitrary cookie attributes through user-controlled input, potentially leading to session hijacking or other cookie-based attacks.
CVE-2026-47676	MEDIUM	[hono] Path traversal vulnerability in app.mount() where percent-encoded multi-byte characters cause incorrect prefix stripping, allowing mounted sub-applications to receive unintended paths and potentially bypass security controls or access restricted resources.
AIKIDO-2026-943075	MEDIUM	[hono] The AWS Lambda adapter incorrectly merges multiple Set-Cookie headers into a single comma-separated value, causing clients to misparsed cookies and potentially drop session or CSRF tokens, breaking authentication. This is fixed by emitting Set-Cookie as an array instead.
CVE-2026-54287	MEDIUM	[hono] On AWS Lambda, ALB and VPC Lattice improperly join multiple Set-Cookie headers with commas, causing clients to misparse or drop cookies due to comma-separated formatting conflicts with cookie attributes like Expires dates.
GHSA-v8w9-8mx6-g223	MEDIUM	[hono] Prototype pollution vulnerability in `parseBody({ dot: true })` where specially crafted form field names like `__proto__.x` create objects with `__proto__` properties, potentially enabling prototype pollution if merged unsafely into other objects.
CVE-2026-39410	MEDIUM	[hono] A discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed, enabling attacker-controlled cookies to override legitimate ones through key normalization.
AIKIDO-2026-362336	MEDIUM	[hono] A Lambda@Edge adapter vulnerability causes multi-value HTTP headers to be overwritten instead of preserved, resulting in incomplete header chains reaching application middleware and potentially bypassing access control or auditing mechanisms that depend on complete header data.
CVE-2026-54289	MEDIUM	[hono] A vulnerability in the AWS Lambda@Edge adapter causes repeated HTTP headers to be silently truncated to only the last value instead of preserving all entries, potentially weakening access control decisions based on header chains like X-Forwarded-For and compromising audit trails.
AIKIDO-2026-10703	MEDIUM	[hono] JSX runtime fails to sanitize tag names in `jsx()` and `createElement()`, allowing untrusted tag input to inject markup and reshape generated HTML, potentially enabling XSS attacks.
AIKIDO-2026-10775	MEDIUM	[hono] JSX style-object serialization fails to properly escape CSS declaration context, allowing untrusted style values or property names to inject additional CSS declarations. This enables UI manipulation and style-driven data exfiltration attacks.
CVE-2026-44458	MEDIUM	[hono] The JSX renderer fails to properly escape style attribute object values for CSS, allowing untrusted input to inject additional CSS declarations. This enables CSS injection attacks but does not permit JavaScript execution or HTML attribute breakout.
CVE-2026-56761	MEDIUM	[hono] HTML injection vulnerability in JSX server-side rendering allows attackers to inject arbitrary HTML by crafting malformed attribute names with special characters, potentially enabling XSS attacks and unauthorized content injection.
AIKIDO-2026-10774	LOW	[hono] JWT verification accepts malformed NumericDate claims for expiration, not-before, and issued-at fields, allowing falsy, non-finite, or non-numeric values to bypass time-based validation checks. This weakens token lifetime security by permitting invalid tokens to be accepted.
CVE-2026-44459	LOW	[hono] Improper JWT NumericDate claim validation allows malformed exp, nbf, and iat values to bypass time-based checks, enabling authentication bypass when applications issue non-compliant tokens or signing keys are compromised.
CVE-2026-44456	LOW	[hono] bodyLimit() middleware fails to enforce maximum request size for chunked transfer encoding, allowing oversized requests to bypass the limit and reach handlers, potentially causing denial of service or resource exhaustion.
AIKIDO-2026-10336	LOW	[hono] Accept header parsing uses a vulnerable regex that causes catastrophic backtracking when processing crafted headers with many segments, enabling denial of service attacks through CPU exhaustion.

🤖 Remediation details

Fix high-severity vulnerabilities in fast-uri and hono via lockfile-only resolution refresh

Short summary

This PR remediates multiple high- and medium-severity vulnerabilities in two packages: fast-uri (URI parsing) and hono (web framework). Both packages were already reachable within the workspace — hono as a direct dependency of apps/worker, and fast-uri as a transitive dependency pulled in through conf → ajv — and both were resolved to vulnerable versions in pnpm-lock.yaml. No manifest (package.json) edits were required; all fixes were applied via lockfile-only resolution updates.

fast-uri

fast-uri is a transitive dependency resolved through apps/cli's direct dependency conf@13.1.0, which depends on ajv@8.18.0, which in turn declares fast-uri: "^3.0.1". The lockfile had stale-pinned fast-uri at 3.1.0, a version within multiple vulnerable ranges. Because ajv@8.18.0's declared range ^3.0.1 already permits 3.1.5, no manifest change was needed — running pnpm update fast-uri --recursive --lockfile-only was sufficient to re-resolve the transitive to 3.1.5, the minimum version that clears all identified advisories for this package.

hono

hono is a direct dependency of apps/worker, declared as ^4.7.0 in that workspace member's package.json. The lockfile had resolved it to 4.12.5, which falls within the vulnerable ranges for all identified advisories. The declared caret range already permits 4.12.25 and above, so no manifest edit was required; a lockfile-only update via pnpm update --latest hono --recursive --lockfile-only advanced the resolved version to 4.12.33, clearing all identified advisories for this package.

Version changes

Package	From	To	Why updated
`hono`	`4.12.5`	`4.12.33`	Direct CVE fix — lockfile refresh within existing `^4.7.0` range
`fast-uri`	`3.1.0`	`3.1.5`	Transitive CVE fix via `ajv@8.18.0` — lockfile refresh within existing `^3.0.1` range

Note

Medium Risk
Dependency-only changes on the worker’s core HTTP framework (hono); behavior should be patch-level but warrants smoke-testing API, auth middleware, and SSR views after deploy.

Overview
This PR addresses security advisories by upgrading hono on the Cloudflare worker and refreshing transitive resolution for fast-uri in the lockfile.

In apps/worker, the direct hono dependency moves from ^4.7.0 (lockfile had 4.12.5) to ^4.12.33, which is what actually runs the worker’s routing, middleware factory, and JSX/HTML rendering paths.

The pnpm-lock.yaml update also pins fast-uri from 3.1.0 to 3.1.5 (pulled in via ajv / CLI tooling), and includes incidental lockfile churn (e.g. libc metadata on native optional packages, vite no longer listing an optional tsx peer, and CLI entries for highlight.js / marked-highlight if those were part of the same refresh).

^{Reviewed by Cursor Bugbot for commit 51e7480. Bugbot is set up for automated code reviews on this repo. Configure here.}

aikido-autofix · 2026-08-05T00:17:09Z

Closed by Aikido: a new AutoFix has been created → #11

fix(security): update dependencies

51e7480

aikido-autofix Bot mentioned this pull request Aug 2, 2026

[Aikido] Fix 39 security issues in fast-uri, hono #8

Closed

aikido-autofix Bot closed this Aug 5, 2026

aikido-autofix Bot deleted the fix/aikido-security-update-packages-79615312-7w4t branch August 5, 2026 00:17

Navigation Menu

Uh oh!

[Aikido] Fix 40 security issues in fast-uri, hono - #10

[Aikido] Fix 40 security issues in fast-uri, hono#10
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-79615312-7w4t

aikido-autofix Bot commented Aug 2, 2026 •

edited by cursor Bot

Loading

Uh oh!

aikido-autofix Bot commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

aikido-autofix Bot commented Aug 2, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Short summary

fast-uri

hono

Version changes

Uh oh!

aikido-autofix Bot commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

aikido-autofix Bot commented Aug 2, 2026 •

edited by cursor Bot

Loading