[Aikido] Fix 45 security issues in fast-uri, hono

[aikido-autofix]

Upgrade fast-uri and hono to fix critical SSRF/host-bypass and path-traversal vulnerabilities in URI parsing, normalization, and authority handling.

⚠️ Breaking changes in this upgrade

All breaking changes by upgrading hono from version 4.12.5 to 4.13.5 (CHANGELOG)

Version	Description
4.13.0	Cache Middleware internal cache key format changed for all methods including GET; cached entries now stored under internal URL format /.hono/cache?__hono_cache_key=... instead of original request URL, requiring updates to any external cache purging logic that uses caches.delete() with the original request URL
4.13.0	JSX RefObject<T> type changed to { current: T } requiring nullable refs to be typed as RefObject<T | null> and useRef(undefined) to be passed instead of useRef()
4.13.0	RegExpRouter now throws UnsupportedPathError at route registration time instead of at first matching request, causing misconfigured routes to fail at startup rather than runtime

✅ 45 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-878106	HIGH	[fast-uri] Inconsistent URI authority parsing allows backslash characters to be interpreted differently than Node's WHATWG URL implementation, enabling attackers to bypass host allowlists, SSRF filters, and redirect validation checks.
CVE-2026-6321	HIGH	[fast-uri] URI normalization vulnerability allows path traversal bypass through encoded separators and dot segments. Attackers can craft URLs that appear to comply with path-based policies but normalize to unauthorized locations, enabling policy enforcement bypass.
CVE-2026-6322	HIGH	[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and potentially circumvent URL-based access controls.
AIKIDO-2026-507986	HIGH	[fast-uri] A host canonicalization vulnerability in Unicode/IDN value handling could allow security bypasses due to inconsistent ASCII/Unicode host processing. The fix implements WHATWG URL parsing for proper normalization to prevent authentication and validation bypasses.
CVE-2026-13676	HIGH	[fast-uri] A vulnerability in IDN hostname canonicalization allows Unicode hostnames to bypass host-based security policies (denylists, loopback filtering, redirects) when fast-uri's output differs from standard URL parsers. This enables attackers to circumvent security controls that rely on host validation.
CVE-2026-16221	HIGH	[fast-uri] A parsing discrepancy in fast-uri allows backslash characters to bypass host-based security policies like allowlists and SSRF filters, enabling attackers to redirect requests to unintended destinations including internal hosts and cloud metadata endpoints.
AIKIDO-2026-236835	HIGH	[fast-uri] A parsing discrepancy allows attackers to bypass host allowlists and SSRF filters by using alternative authority introducers (like \\ or /\) that fast-uri treats as paths but Node's URL parser treats as authority, enabling redirection to unintended destinations.
CVE-2026-18446	HIGH	[fast-uri] URI parsing inconsistency allows backslash-based introducers to bypass host validation, enabling attackers to evade allowlists and SSRF filters by exploiting differences between fast-uri and Node's WHATWG parser.
AIKIDO-2026-695913	HIGH	[fast-uri] Unsafe percent-decoding in URL scheme components allows attackers to bypass URL validation and inject malicious hosts or header content through encoded characters like %2f and %0d%0a. This enables URL redirection bypasses, allowlist evasion, and header injection attacks on applications normalizing untrusted URLs.
AIKIDO-2026-87893	HIGH	[fast-uri] Improper validation of IPv6 literals in URIs allows malformed addresses to be silently truncated into different valid addresses, enabling host-policy bypass and routing to unintended addresses like loopback or link-local IPs.
CVE-2026-75975	HIGH	[fast-uri] A custom IPv6 parser fails to validate complete grammar, allowing invalid trailing text in bracketed literals to be silently discarded and malformed hosts normalized to different valid IPv6 addresses. This enables server-side request forgery and address-policy bypass attacks when applications normalize untrusted URLs before outbound requests or routing decisions.
CVE-2026-76172	HIGH	[fast-uri] A URI parser vulnerability allows attackers to bypass host allowlists through percent-encoded slashes in the scheme component, enabling off-site redirects and server-side request forgery attacks. The parser's inconsistent re-escaping between scheme and host components causes mismatches between parsed and serialized URIs, with control characters potentially reaching output as raw carriage returns and line feeds.
CVE-2026-39408	HIGH	[hono] Path traversal vulnerability in toSSG() allows attackers to write files outside the configured output directory during static site generation using specially crafted dynamic route parameters. This enables arbitrary file write attacks that could compromise system integrity.
AIKIDO-2026-11187	HIGH	[hono] CORS middleware with credentials enabled and wildcard origin incorrectly reflects the request Origin header instead of rejecting it, allowing any third-party page to make credentialed cross-origin requests and read cookie-authenticated API responses.
CVE-2026-54290	HIGH	[hono] CORS middleware with credentials enabled and default wildcard origin reflects any request origin, allowing arbitrary sites to make credentialed cross-origin requests and access cookie-authenticated endpoints. This enables information disclosure and unauthorized access to sensitive data.
AIKIDO-2026-10704	MEDIUM	[hono] A body size limit middleware vulnerability allowed oversized payloads to bypass the limit check and reach application logic when Content-Length was missing or bodies were chunked, due to asynchronous limit enforcement. This could enable DoS attacks or unintended data processing despite configured size restrictions.
CVE-2026-47673	MEDIUM	[hono] JWT and JWK middlewares fail to verify the Authorization header uses the Bearer scheme, allowing authentication bypass when valid JWTs are presented with alternative scheme identifiers like Basic or Token.
AIKIDO-2026-571543	MEDIUM	[hono] The body-limit middleware on AWS Lambda adapters can be bypassed by declaring a small Content-Length header while sending a larger actual body, allowing oversized payloads to pass validation checks.
CVE-2026-54288	MEDIUM	[hono] Body Limit Middleware improperly validates request size by trusting the Content-Length header instead of actual payload size, allowing attackers to bypass limits and send oversized bodies on AWS Lambda environments, potentially causing DoS or resource exhaustion.
CVE-2026-44455	MEDIUM	[hono] Improper handling of JSX element tag names allows unvalidated tag names to be inserted into HTML output during server-side rendering, enabling HTML injection attacks when untrusted input is used as tag names via jsx() or createElement() APIs.
AIKIDO-2026-11189	MEDIUM	[hono] A path traversal vulnerability in serve-static middleware allows unauthenticated attackers to read protected static files on Windows by using encoded backslashes in URLs to bypass prefix-mounted guards and access files outside the configured root.
CVE-2026-54286	MEDIUM	[hono] Path traversal vulnerability on Windows where encoded backslashes (%5C) in request paths are decoded and treated as separators, allowing attackers to bypass middleware protections and read arbitrary static files.
CVE-2026-39407	MEDIUM	[hono] Path handling inconsistency in serveStatic allows bypassing route-based authorization middleware by using repeated slashes (//) in request paths, enabling unauthorized access to protected static files.
CVE-2026-39409	MEDIUM	[hono] The ipRestriction() middleware fails to canonicalize IPv4-mapped IPv6 addresses before applying IPv4 allow/deny rules, allowing attackers to bypass IP-based access controls in dual-stack environments.
GHSA-26pp-8wgv-hjvm	MEDIUM	[hono] Cookie names are not validated in setCookie(), serialize(), or serializeSigned(), allowing invalid characters that can cause malformed Set-Cookie headers and runtime errors. While modern runtimes reject these invalid headers before sending, this creates inconsistent validation between cookie parsing and serialization.
AIKIDO-2026-10776	MEDIUM	[hono] Cache middleware improperly caches responses with varying Authorization or Cookie headers, allowing cached user-specific data to be served to different authenticated users, resulting in information disclosure.
CVE-2026-44457	MEDIUM	[hono] Cache Middleware fails to skip caching for responses with Vary: Authorization or Vary: Cookie headers, allowing cached responses from one authenticated user to be served to other users, resulting in information disclosure.
CVE-2026-47674	MEDIUM	[hono] The ip-restriction middleware fails to match non-canonical IPv6 representations against configured rules, allowing attackers to bypass IP-based access controls through alternative address formats.
CVE-2026-47675	MEDIUM	[hono] The serialize() function fails to validate sameSite and priority cookie options against characters that corrupt Set-Cookie headers, allowing attackers to inject arbitrary cookie attributes through user-controlled input, potentially leading to session hijacking or other cookie-based attacks.
CVE-2026-47676	MEDIUM	[hono] Path traversal vulnerability in app.mount() where percent-encoded multi-byte characters cause incorrect prefix stripping, allowing mounted sub-applications to receive unintended paths and potentially bypass security controls or access restricted resources.
AIKIDO-2026-943075	MEDIUM	[hono] Improper handling of Set-Cookie headers in AWS Lambda adapter causes multiple cookies to be merged into a single comma-separated header, preventing clients from parsing them correctly and potentially breaking authentication or session management.
CVE-2026-54287	MEDIUM	[hono] On AWS Lambda, ALB and VPC Lattice improperly join multiple Set-Cookie headers with commas, causing clients to misparse or drop cookies due to comma-separated formatting conflicts with cookie attributes like Expires dates.
GHSA-v8w9-8mx6-g223	MEDIUM	[hono] Prototype pollution vulnerability in parseBody({ dot: true }) where specially crafted form field names like __proto__.x create objects with __proto__ properties, potentially enabling prototype pollution if merged unsafely into other objects.
CVE-2026-39410	MEDIUM	[hono] Cookie prefix protections can be bypassed due to discrepancies between browser parsing and parse() handling, allowing attackers to override legitimate cookies with attacker-controlled ones through cookie name normalization.
AIKIDO-2026-362336	MEDIUM	[hono] A Lambda@Edge adapter vulnerability causes multi-value HTTP headers to be overwritten instead of preserved, resulting in incomplete header chains reaching application middleware and potentially bypassing access control or auditing mechanisms that depend on complete header data.
CVE-2026-54289	MEDIUM	[hono] A vulnerability in the AWS Lambda@Edge adapter causes repeated HTTP headers to be silently truncated to only the last value instead of preserving all entries, potentially weakening access control decisions based on header chains like X-Forwarded-For and compromising audit trails.
AIKIDO-2026-10703	MEDIUM	[hono] JSX runtime fails to sanitize tag names in jsx() and createElement(), allowing untrusted tag input to inject markup and reshape generated HTML, potentially enabling XSS attacks.
AIKIDO-2026-10775	MEDIUM	[hono] JSX style-object serialization fails to properly escape CSS declaration context, allowing untrusted style values or property names to inject additional CSS declarations. This enables UI manipulation and style-driven data exfiltration attacks.
CVE-2026-44458	MEDIUM	[hono] The JSX renderer fails to properly escape style attribute object values for CSS, allowing untrusted input to inject additional CSS declarations. This enables CSS injection attacks but does not permit JavaScript execution or HTML attribute breakout.
CVE-2026-56761	MEDIUM	[hono] HTML injection vulnerability in JSX server-side rendering allows attackers to inject arbitrary HTML by crafting malformed attribute names with special characters, potentially enabling XSS attacks and unauthorized content injection.
AIKIDO-2026-10774	LOW	[hono] JWT verification accepts malformed NumericDate claims for expiration, not-before, and issued-at fields, allowing falsy, non-finite, or non-numeric values to bypass time-based validation checks. This weakens token lifetime security by permitting invalid tokens that should be rejected.
CVE-2026-44459	LOW	[hono] Improper JWT NumericDate claim validation allows malformed exp, nbf, and iat values to bypass time-based checks, enabling authentication bypass when applications issue non-compliant tokens or signing keys are compromised.
CVE-2026-44456	LOW	[hono] bodyLimit() middleware fails to enforce maximum request size for requests without Content-Length headers (e.g., chunked encoding), allowing oversized payloads to reach handlers and bypass size restrictions.
AIKIDO-2026-10336	LOW	[hono] Accept header parsing uses a vulnerable regex that causes catastrophic backtracking when processing crafted headers with many segments, leading to denial of service through excessive CPU consumption.

🤖 Remediation details

Fix high/medium/low severity vulnerabilities in hono and fast-uri

Short summary

This PR remediates a series of security advisories affecting two packages: hono (the HTTP framework used directly in the apps/worker workspace member) and fast-uri (a transitive dependency resolved through ajv). The fix updates the declared version range for hono in apps/worker/package.json and refreshes pnpm-lock.yaml to resolve both packages to their patched versions.

hono

hono is declared as a direct dependency in apps/worker/package.json. The installed version 4.12.5 fell within the vulnerable ranges for all listed advisories, with the highest patched floor being 4.12.25. The declared range was bumped from ^4.7.0 to ^4.12.25, which pnpm resolved to 4.13.5 (the latest compatible release), clearing every advisory against this package in a single manifest edit and lockfile refresh.

fast-uri

fast-uri is a transitive dependency pulled in by ajv@8.18.0, which declares it as ^3.0.1. The installed version 3.1.0 was vulnerable across all listed advisories, with the required patched floor being 3.1.6. Because ajv@8.18.0 was already the first fixing parent version and its declared range already admitted 3.1.6, no parent bump was required — a lockfile-only refresh was sufficient. The --safe-chain-skip-minimum-package-age flag was needed to allow pnpm's resolver to select the newer fast-uri release, which it had been suppressing due to its minimum package age supply-chain policy.

Version changes

Package	From	To	Why updated
hono	^4.7.0 (resolved 4.12.5)	^4.12.25 (resolved 4.13.5)	Direct CVE fix — manifest range bumped to enforce patched floor
fast-uri	3.1.0	3.1.6	Transitive CVE fix via lockfile refresh under ajv@8.18.0

---

Note

Medium Risk
Upgrades security-sensitive HTTP/URI libraries on the worker without code changes; validate worker routes and JSX pages after deploy, especially if you later adopt Hono cache or stricter router registration.

Overview
Security dependency refresh for the Cloudflare worker HTTP stack and transitive URI parsing used elsewhere in the monorepo.

apps/worker/package.json raises the direct hono range from ^4.7.0 to ^4.13.5 (lockfile resolves 4.12.5 → 4.13.5). pnpm-lock.yaml is regenerated so fast-uri moves 3.1.0 → 3.1.6 under ajv, along with minor lockfile metadata (e.g. libc on platform packages) and dropping unused optional tsx from the worker’s Vite dependency tree.

No worker source changes—only manifest and lockfile. Hono 4.13 can change cache middleware keying, JSX RefObject typing, and RegExpRouter startup errors; this app uses core Hono, hono/factory, and hono/jsx routing/HTML, not the cache or serve-static middleware called out in the advisory list.

^{Reviewed by Cursor Bugbot for commit 4b4253e. Bugbot is set up for automated code reviews on this repo. Configure here.}