[Aikido] Fix security issue in fast-uri via minor version upgrade from 3.1.0 to 3.1.6 in apps

[aikido-autofix]

Upgrade fast-uri to fix SSRF/host-bypass, path-traversal, authority-spoofing, and Unicode-normalization vulnerabilities in URI parsing and comparison.

✅ 11 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-878106	HIGH	[fast-uri] URI authority parsing fails to treat backslashes as delimiters, allowing different host interpretations compared to Node's WHATWG URL parser, enabling bypass of host allowlists, SSRF filters, and redirect validation checks. The vulnerability permits attackers to circumvent security controls through crafted URIs containing backslashes.
CVE-2026-6321	HIGH	[fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs.
CVE-2026-6322	HIGH	[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.
AIKIDO-2026-507986	HIGH	[fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization.
CVE-2026-13676	HIGH	[fast-uri] A vulnerability in IDN hostname canonicalization allows Unicode hostnames to bypass host-based security policies (denylists, loopback filtering, redirects) when fast-uri's output differs from standard URL parsers. This enables attackers to circumvent security controls that rely on host validation.
CVE-2026-16221	HIGH	[fast-uri] A parsing discrepancy in fast-uri allows backslash characters to bypass host-based security policies like allowlists and SSRF filters, enabling attackers to redirect requests to unintended destinations including internal hosts and cloud metadata endpoints.
AIKIDO-2026-236835	HIGH	[fast-uri] A parsing discrepancy allows attackers to bypass host allowlists and SSRF filters by using alternative authority introducers (backslashes, mixed slashes, whitespace) that fast-uri treats as paths but Node's URL parser treats as authority, enabling redirection to unintended destinations.
CVE-2026-18446	HIGH	[fast-uri] URI parsing inconsistency allows attackers to bypass host-based security policies by using backslashes instead of forward slashes, causing fast-uri to parse differently than Node's URL parser and potentially enabling SSRF attacks or unintended redirects.
AIKIDO-2026-695913	HIGH	[fast-uri] Unsafe percent-decoding in URL scheme component allows attackers to bypass URL validation and inject malicious hosts or header content through normalization and resolution functions. This enables URL redirection attacks, allowlist bypasses, and header injection in applications processing untrusted URLs.
AIKIDO-2026-87893	HIGH	[fast-uri] Improper validation of IPv6 literals in URIs allows malformed addresses to be silently truncated into different valid addresses, enabling host-policy bypass and routing to unintended addresses like loopback or link-local IPs.

---

Note

Low Risk
Lockfile-only dependency patch with no CLI logic changes; residual risk is limited to whether nested ajv/fast-uri@3.1.0 remains reachable at runtime versus the pinned 3.1.6.

Overview
Updates apps/cli/bun.lock so @sharehtml/cli resolves fast-uri@3.1.6 instead of 3.1.0, adding it as a direct workspace dependency to enforce the patched version.

This is a dependency-only security bump (Aikido/CVE remediation) addressing URI parsing and normalization issues—host allowlist/SSRF bypass, path traversal via encoded segments, authority spoofing, and IDN/IPv6 handling—in code paths that use fast-uri (including via conf → ajv).

No application source changes in this diff. Note the lockfile still records ajv/fast-uri@3.1.0 as a nested copy under ajv; the new direct pin is what pulls 3.1.6 for the CLI workspace.

^{Reviewed by Cursor Bugbot for commit 4e61a0e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4e61a0e. Configure here.}

[cursor]

Vulnerable fast-uri retained under ajv

High Severity

The lockfile adds fast-uri@3.1.6 as a workspace dependency while pinning ajv/fast-uri to 3.1.0. ajv is the only runtime consumer of fast-uri via conf, so the vulnerable parser remains on the nested install path and the advertised CVE fixes do not take effect.

Additional Locations (1)

• apps/cli/bun.lock#L9-L10

 

^{Reviewed by Cursor Bugbot for commit 4e61a0e. Configure here.}