[Aikido] Fix 41 security issues in fast-uri, hono

[aikido-autofix]

Upgrade fast-uri and hono to fix critical SSRF/host-bypass and path-traversal vulnerabilities caused by improper URI normalization and authority parsing.

⚠️ Breaking changes analysis not available for: hono

✅ No breaking changes for: fast-uri

✅ 41 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-878106	HIGH	[fast-uri] URI authority parsing fails to treat backslashes as delimiters, allowing different host interpretations compared to Node's WHATWG URL parser, enabling bypass of host allowlists, SSRF filters, and redirect validation checks. The vulnerability permits attackers to circumvent security controls through crafted URIs containing backslashes.
CVE-2026-6321	HIGH	[fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs.
CVE-2026-6322	HIGH	[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.
AIKIDO-2026-507986	HIGH	[fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization.
CVE-2026-13676	HIGH	[fast-uri] A vulnerability in IDN hostname canonicalization allows Unicode hostnames to bypass host-based security policies (denylists, loopback filtering, redirects) when fast-uri's output differs from standard URL parsers. This enables attackers to circumvent security controls that rely on host validation.
CVE-2026-16221	HIGH	[fast-uri] A parsing discrepancy in fast-uri allows backslash characters to bypass host-based security policies like allowlists and SSRF filters, enabling attackers to redirect requests to unintended destinations including internal hosts and cloud metadata endpoints.
AIKIDO-2026-236835	HIGH	[fast-uri] A parsing discrepancy allows attackers to bypass host allowlists and SSRF filters by using alternative authority introducers (backslashes, mixed slashes, whitespace) that fast-uri treats as paths but Node's URL parser treats as authority, enabling redirection to unintended destinations.
CVE-2026-18446	HIGH	[fast-uri] URI parsing inconsistency allows attackers to bypass host-based security policies by using backslashes instead of forward slashes, causing fast-uri to parse differently than Node's URL parser and potentially enabling SSRF attacks or unintended redirects.
CVE-2026-39408	HIGH	[hono] Path traversal vulnerability in toSSG() allows attackers to write files outside the configured output directory during static site generation using specially crafted dynamic route parameters. This enables arbitrary file write attacks that could compromise system integrity.
AIKIDO-2026-11187	HIGH	[hono] CORS middleware with credentials enabled and wildcard origin incorrectly reflects the request Origin header instead of rejecting it, allowing any third-party page to make credentialed cross-origin requests and read cookie-authenticated API responses.
CVE-2026-54290	HIGH	[hono] CORS middleware with credentials enabled and default wildcard origin incorrectly reflects any request origin, allowing arbitrary sites to make credentialed cross-origin requests and access cookie-authenticated endpoints.
AIKIDO-2026-10704	MEDIUM	[hono] A body size limit middleware vulnerability allowed oversized payloads to bypass the limit check and reach application logic when Content-Length was missing or bodies were chunked, due to asynchronous limit enforcement. This could enable DoS attacks or unintended data processing despite configured size restrictions.
CVE-2026-47673	MEDIUM	[hono] JWT and JWK middlewares fail to verify the Authorization header uses the Bearer scheme, allowing authentication bypass when valid JWTs are presented with alternative scheme identifiers like Basic or Token.
AIKIDO-2026-571543	MEDIUM	[hono] The body-limit middleware on AWS Lambda adapters can be bypassed by declaring a small Content-Length header while sending a larger actual body, allowing oversized payloads to pass validation checks. This vulnerability enables denial-of-service attacks and potential remote code execution through request body processing.
CVE-2026-54288	MEDIUM	[hono] Body Limit Middleware improperly validates request size by trusting the Content-Length header instead of actual payload size, allowing attackers to bypass limits and send oversized bodies on AWS Lambda environments, potentially causing DoS or resource exhaustion.
CVE-2026-44455	MEDIUM	[hono] Improper handling of JSX element tag names allows unvalidated tag names to be inserted into HTML output during server-side rendering, enabling HTML injection attacks when untrusted input is used as tag names via jsx() or createElement() APIs.
AIKIDO-2026-11189	MEDIUM	[hono] A path traversal vulnerability in the serve-static middleware allows attackers to bypass authentication guards on Windows by using encoded backslashes in URLs to access protected static files. The vulnerability enables unauthenticated file disclosure without escaping the configured root directory.
CVE-2026-54286	MEDIUM	[hono] Path traversal vulnerability on Windows where encoded backslashes (%5C) in request paths are decoded and treated as separators, allowing attackers to bypass middleware protections and read arbitrary static files.
CVE-2026-39407	MEDIUM	[hono] Path handling inconsistency in serveStatic allows bypassing route-based authorization middleware by using repeated slashes (//) in request paths, enabling unauthorized access to protected static files.
CVE-2026-39409	MEDIUM	[hono] The ipRestriction() middleware fails to canonicalize IPv4-mapped IPv6 addresses before applying IPv4 allow/deny rules, allowing attackers to bypass IP-based access controls in dual-stack environments.
GHSA-26pp-8wgv-hjvm	MEDIUM	[hono] Cookie names are not validated in setCookie(), serialize(), or serializeSigned(), allowing invalid characters that can cause malformed Set-Cookie headers and runtime errors when processing untrusted cookie names.
AIKIDO-2026-10776	MEDIUM	[hono] Cache middleware improperly caches responses with varying Authorization or Cookie headers, allowing cached user-specific data to be served to different authenticated users, resulting in information disclosure.
CVE-2026-44457	MEDIUM	[hono] Cache Middleware fails to skip caching for responses with Vary: Authorization or Vary: Cookie headers, allowing cached responses from one authenticated user to be served to other users, resulting in information disclosure.
CVE-2026-47674	MEDIUM	[hono] The ip-restriction middleware fails to match non-canonical IPv6 representations against configured rules, allowing attackers to bypass IP-based access controls through alternative address formats.
CVE-2026-47675	MEDIUM	[hono] The serialize() function fails to validate sameSite and priority cookie options against characters that corrupt Set-Cookie headers, allowing attackers to inject arbitrary cookie attributes through user-controlled input, potentially leading to session hijacking or other cookie-based attacks.
CVE-2026-47676	MEDIUM	[hono] Path traversal vulnerability in app.mount() where percent-encoded multi-byte characters cause incorrect prefix stripping, allowing mounted sub-applications to receive unintended paths and potentially bypass security controls or access restricted resources.
AIKIDO-2026-943075	MEDIUM	[hono] The AWS Lambda adapter incorrectly merges multiple Set-Cookie headers into a single comma-separated value, causing clients to misparsed cookies and potentially drop session or CSRF tokens, breaking authentication. This is fixed by emitting Set-Cookie as an array instead.
CVE-2026-54287	MEDIUM	[hono] On AWS Lambda, ALB and VPC Lattice improperly join multiple Set-Cookie headers with commas, causing clients to misparse or drop cookies due to comma-separated formatting conflicts with cookie attributes like Expires dates.
GHSA-v8w9-8mx6-g223	MEDIUM	[hono] Prototype pollution vulnerability in parseBody({ dot: true }) where specially crafted form field names like __proto__.x create objects with __proto__ properties, potentially enabling prototype pollution if merged unsafely into other objects.
CVE-2026-39410	MEDIUM	[hono] A discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed, enabling attacker-controlled cookies to override legitimate ones through key normalization.
AIKIDO-2026-362336	MEDIUM	[hono] A Lambda@Edge adapter vulnerability causes multi-value HTTP headers to be overwritten instead of preserved, resulting in incomplete header chains reaching application middleware and potentially bypassing access control or auditing mechanisms that depend on complete header data.
CVE-2026-54289	MEDIUM	[hono] A vulnerability in the AWS Lambda@Edge adapter causes repeated HTTP headers to be silently truncated to only the last value instead of preserving all entries, potentially weakening access control decisions based on header chains like X-Forwarded-For and compromising audit trails.
AIKIDO-2026-10703	MEDIUM	[hono] JSX runtime fails to sanitize tag names in jsx() and createElement(), allowing untrusted tag input to inject markup and reshape generated HTML, potentially enabling XSS attacks.
AIKIDO-2026-10775	MEDIUM	[hono] JSX style-object serialization fails to properly escape CSS declaration context, allowing untrusted style values or property names to inject additional CSS declarations. This enables UI manipulation and style-driven data exfiltration attacks.
CVE-2026-44458	MEDIUM	[hono] The JSX renderer fails to properly escape style attribute object values for CSS, allowing untrusted input to inject additional CSS declarations. This enables CSS injection attacks but does not permit JavaScript execution or HTML attribute breakout.
CVE-2026-56761	MEDIUM	[hono] HTML injection vulnerability in JSX server-side rendering allows attackers to inject arbitrary HTML by crafting malformed attribute names with special characters, potentially enabling XSS attacks and unauthorized content injection.
AIKIDO-2026-10774	LOW	[hono] JWT verification accepts malformed NumericDate claims for expiration, not-before, and issued-at fields, allowing falsy, non-finite, or non-numeric values to bypass time-based validation checks. This weakens token lifetime security by permitting invalid tokens to be accepted.
CVE-2026-44459	LOW	[hono] Improper JWT NumericDate claim validation allows malformed exp, nbf, and iat values to bypass time-based checks, enabling authentication bypass when applications issue non-compliant tokens or signing keys are compromised.
CVE-2026-44456	LOW	[hono] bodyLimit() middleware fails to enforce maximum request size for chunked transfer encoding, allowing oversized requests to bypass the limit and reach handlers, potentially causing denial of service or resource exhaustion.
AIKIDO-2026-10336	LOW	[hono] Accept header parsing uses a vulnerable regex that causes catastrophic backtracking when processing crafted headers with many segments, enabling denial of service attacks through CPU exhaustion.

🤖 Remediation details

Fix high/medium/low severity vulnerabilities in fast-uri and hono

Short summary

This PR remediates multiple high, medium, and low severity vulnerabilities in two packages: fast-uri (transitive, resolved via lockfile refresh) and hono (direct dependency, resolved via manifest bump). The declared version of hono was updated in apps/worker/package.json, and pnpm-lock.yaml was refreshed to reflect both the new hono resolution and the updated fast-uri transitive resolution.

fast-uri

fast-uri appears in the lockfile as a transitive dependency pulled in through the chain conf → ajv → fast-uri. The previously resolved version (3.1.0) fell within every vulnerable range covered by this task; the required floor is 3.1.5. No manifest change was needed because ajv@8.18.0 already declares fast-uri: "^3.0.1", a range that permits 3.1.5—the lockfile simply had a stale pin. Running pnpm update fast-uri --lockfile-only --recursive refreshed the transitive resolution to 3.1.5, clearing all associated advisories without any override.

hono

hono is a direct dependency declared in apps/worker/package.json. The previously declared range (^4.7.0) resolved to 4.12.5, which falls within every vulnerable range covered by this task; the required floor is 4.12.25. The declared range was narrowed to ^4.12.25 in apps/worker/package.json to enforce the security floor, and pnpm install --lockfile-only resolved it to 4.12.33.

Version changes

Package	From	To	Why updated
hono	^4.7.0 → resolved 4.12.5	^4.12.25 → resolved 4.12.33	Direct CVE fix — manifest range narrowed to enforce patched floor
fast-uri	3.1.0 (lockfile)	3.1.5 (lockfile)	Transitive CVE fix — stale lockfile pin refreshed; parent ajv@8.18.0 range already permitted 3.1.5

---

Note

Medium Risk
Touches the Cloudflare worker’s core hono dependency (auth, APIs, SSR); behavior may shift across many security fixes even though the change is version-only.

Overview
Security-focused dependency updates: hono in apps/worker is raised from ^4.7.0 to ^4.12.25 (lockfile resolves 4.12.33), addressing multiple advisories in the worker’s HTTP stack (routing, middleware, JSX HTML rendering).

pnpm-lock.yaml is regenerated so transitive fast-uri moves 3.1.0 → 3.1.5 (via ajv / conf), fixing URI normalization and host-parsing bypass issues without a direct manifest change. The lockfile also reflects routine resolution churn (e.g. worker vite no longer pulling optional tsx, libc metadata on native optional deps, and apps/cli markdown deps appearing in the pnpm graph where they were already declared).

^{Reviewed by Cursor Bugbot for commit 5581240. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5581240. Configure here.}

[cursor]

Incomplete fast-uri lockfile fix

Medium Severity

fast-uri is bumped to 3.1.5 in pnpm-lock.yaml, but apps/cli/bun.lock still pins fast-uri@3.1.0. That is the only package that pulls in conf → ajv → fast-uri, and the CLI builds with bun build, which bundles dependencies by default, so Bun installs can still ship the vulnerable transitive version.

 

^{Reviewed by Cursor Bugbot for commit 5581240. Configure here.}

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #13