[Aikido] Fix security issue in fast-uri via minor version upgrade from 3.1.0 to 3.1.5 in apps

[aikido-autofix]

Upgrade fast-uri to fix SSRF/host-bypass, path-traversal, authority-spoofing, and Unicode-normalization vulnerabilities in URI parsing and comparison.

✅ 8 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-878106	HIGH	[fast-uri] URI authority parsing fails to treat backslashes as delimiters, allowing different host interpretations compared to Node's WHATWG URL parser, enabling bypass of host allowlists, SSRF filters, and redirect validation checks. The vulnerability permits attackers to circumvent security controls through crafted URIs containing backslashes.
CVE-2026-6321	HIGH	[fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs.
CVE-2026-6322	HIGH	[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.
AIKIDO-2026-507986	HIGH	[fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization.
CVE-2026-13676	HIGH	[fast-uri] A vulnerability in IDN hostname canonicalization allows Unicode hostnames to bypass host-based security policies (denylists, loopback filtering, redirects) when fast-uri's output differs from standard URL parsers. This enables attackers to circumvent security controls that rely on host validation.
CVE-2026-16221	HIGH	[fast-uri] A parsing discrepancy in fast-uri allows backslash characters to bypass host-based security policies like allowlists and SSRF filters, enabling attackers to redirect requests to unintended destinations including internal hosts and cloud metadata endpoints.
AIKIDO-2026-236835	HIGH	[fast-uri] A parsing discrepancy allows attackers to bypass host allowlists and SSRF filters by using alternative authority introducers (backslashes, mixed slashes, whitespace) that fast-uri treats as paths but Node's URL parser treats as authority, enabling redirection to unintended destinations.

---

Note

Low Risk
Patch-level dependency upgrade with no application logic changes; residual risk is limited to whether nested ajv still resolves an older fast-uri copy.

Overview
Pins fast-uri@3.1.5 on @sharehtml/cli in apps/cli/bun.lock, replacing the prior 3.1.0 resolution for the workspace root dependency.

This is a dependency-only security bump (no CLI source changes) aimed at patched URI parsing/normalization behavior—host allowlist/SSRF bypasses, path traversal via encoded segments, authority spoofing, and IDN/Unicode host mismatches vs standard parsers.

Note: the lockfile still records ajv/fast-uri@3.1.0 under ajv; only the direct CLI fast-uri entry moves to 3.1.5 unless a follow-up dedupes or overrides nested ajv usage.

^{Reviewed by Cursor Bugbot for commit 6b962d8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6b962d8. Configure here.}

[cursor]

Vulnerable fast-uri still resolved

High Severity

The lockfile adds top-level fast-uri@3.1.5, but also pins ajv/fast-uri to 3.1.0. conf → ajv is the real consumer, so installs still get the vulnerable build. ajv already allows ^3.0.1, so that nested pin blocks the CVE upgrade. The workspace entry also is not mirrored in package.json.

Additional Locations (2)

• apps/cli/bun.lock#L9-L10
• apps/cli/bun.lock#L46-L47

 

^{Reviewed by Cursor Bugbot for commit 6b962d8. Configure here.}

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #12