[Aikido] Fix 17 security issues in fast-xml-parser, fast-uri, aws-cdk-lib and 5 more by aikido-autofix[bot] · Pull Request #41 · pixelfusion/aws-scripts

aikido-autofix · 2026-06-30T23:25:42Z

Upgrade dependencies to fix critical XML entity injection XSS, XML entity expansion DoS attacks, stack overflow in XML builder, URI normalization bypass, and other security vulnerabilities.

⚠️ Breaking changes analysis not available for: aws-cdk-lib, brace-expansion, minimatch, ajv

✅ No breaking changes for: fast-xml-parser, fast-uri, yaml, @smithy/config-resolver

✅ 17 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-25896	🚨 CRITICAL	[fast-xml-parser] A dot (.) in DOCTYPE entity names is treated as a regex wildcard, allowing attackers to shadow built-in XML entities with arbitrary values and bypass entity encoding. This leads to XSS when parsed output is rendered.
CVE-2026-26278	HIGH	[fast-xml-parser] XML entity expansion vulnerability allows attackers to cause denial of service by forcing unlimited entity expansion with minimal input, potentially freezing the application for extended periods.
CVE-2026-27942	HIGH	[fast-xml-parser] XML builder with `preserveOrder:true` causes stack overflow leading to denial of service when processing certain inputs. The application crashes due to improper recursion handling during XML construction.
CVE-2026-33036	HIGH	[fast-xml-parser] Numeric character references and standard XML entities bypass entity expansion limits, allowing attackers to cause XML entity expansion Denial of Service by forcing excessive memory allocation and CPU usage through crafted XML payloads.
CVE-2026-33349	MEDIUM	[fast-xml-parser] XML entity expansion vulnerability where setting maxEntityCount or maxEntitySize to 0 is bypassed due to JavaScript falsy checks, allowing attackers to cause denial of service through memory exhaustion. The vulnerability affects configurations explicitly set to restrict or disable entities.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.
CVE-2026-6321	HIGH	[fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs.
CVE-2026-6322	HIGH	[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
CVE-2026-11417	HIGH	[aws-cdk-lib] OS command injection vulnerability in NodejsFunction local bundling pipeline allows arbitrary command execution if an attacker controls bundling properties like externalModules, define, loader, inject, or esbuildArgs through shell metacharacters injection.
CVE-2026-33750	LOW	[brace-expansion] A brace pattern with zero step value causes an infinite loop, leading to denial of service through process hangs and excessive memory allocation. The vulnerability affects string expansion operations when malicious or malformed patterns are processed.
AIKIDO-2026-10477	LOW	[brace-expansion] A denial-of-service vulnerability allows attackers to craft malicious brace patterns with repeated numeric ranges that cause exponential expansion, consuming excessive CPU and memory until process failure. The fix introduces an optional maximum limit parameter to bound expansion work.
CVE-2026-33532	MEDIUM	[yaml] A stack overflow vulnerability in the YAML parser's node resolution phase allows attackers to trigger a RangeError via deeply nested YAML structures (~2-10 KB), potentially causing denial of service or process termination in applications that don't catch non-YAMLParseError exceptions.
CVE-2026-26996	LOW	[minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs.
CVE-2026-27903	LOW	[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems.
CVE-2026-27904	LOW	[minimatch] Nested extglobs (`*()` and `+()`) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.
GHSA-6475-r3vj-m8vf	LOW	[@smithy/config-resolver] An attacker with environment access could set an invalid region value, potentially routing AWS API calls to non-AWS hosts. A validation enhancement was added to prevent improper endpoint construction through region input validation.
CVE-2025-69873	LOW	[ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort.

🤖 Remediation details

Fix multiple critical/high/medium/low severity vulnerabilities in transitive and direct dependencies

Short summary

This PR remediates security vulnerabilities in eight npm packages: fast-xml-parser, fast-uri, aws-cdk-lib, brace-expansion, yaml, minimatch, @smithy/config-resolver, and ajv. Fixes are applied via two mechanisms: direct version spec bumps in the root package.json (for aws-cdk-lib, @aws-sdk/client-secrets-manager, and @aws-sdk/credential-providers), and a lockfile-only transitive refresh via npm update (for minimatch, brace-expansion, and ajv). The package-lock.json reflects all resolved version changes.

fast-xml-parser

fast-xml-parser was pulled in as a transitive dependency through @aws-sdk/core, which exact-pinned version 4.4.1 — below the patched floor of 4.5.5. Because @aws-sdk/core is not a direct dependency, the fix required bumping the direct dependencies @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers from ^3.348.0 to ^3.844.0 in package.json, which resolves @aws-sdk/core to 3.844.0+ and in turn pulls fast-xml-parser at 5.2.5 (satisfying >=4.5.5). After the bump, fast-xml-parser no longer appears as a separate lockfile entry because it is fully resolved through the updated SDK chain.

fast-uri

fast-uri was a transitive dependency nested under aws-cdk-lib → ajv, resolving to 3.0.6 — below the patched floor of 3.1.1. Bumping aws-cdk-lib from ^2.78.0 to ^2.246.0 in package.json caused the nested ajv to update to 8.20.0, which in turn resolved fast-uri to 3.1.2, satisfying all patched version requirements.

aws-cdk-lib

aws-cdk-lib itself is the vulnerable direct dependency for CVE-2026-11417, requiring a minimum of 2.246.0. The declared spec in package.json was widened from ^2.78.0 to ^2.246.0, resolving to 2.260.0 in the lockfile. This single bump also transitively fixed fast-uri, yaml, minimatch (nested copy), brace-expansion (nested copy), and ajv@8.x (nested copy) within the aws-cdk-lib subtree.

brace-expansion

brace-expansion appeared in three lockfile locations. The copy nested under aws-cdk-lib was fixed by the aws-cdk-lib parent bump (resolved to 5.0.6). The root-hoisted copy (1.1.12, via minimatch@3.x) and the filelist-nested copy (2.0.2, via minimatch@5.x) were both below their respective patched floors (1.1.14 and 2.0.3); these were resolved to 1.1.15 and 2.1.1 respectively via npm update brace-expansion --package-lock-only, which is safe because all parent minimatch ranges already permitted the patched versions.

yaml

yaml was nested inside aws-cdk-lib with an exact pin of 1.10.2, below the patched version 1.10.3. Bumping aws-cdk-lib to ^2.246.0 caused the newer release to pin yaml at 1.10.3, satisfying the patched requirement without any additional lockfile manipulation.

minimatch

minimatch appeared in three lockfile locations. The aws-cdk-lib-nested copy was resolved to 10.2.5 as a side-effect of the aws-cdk-lib parent bump. The root-hoisted copy (3.1.2, shared by eslint, glob, and others) and the filelist-nested copy (5.1.6) were both below their patched floors (3.1.4 and 5.1.8); all declaring parents already used caret ranges permitting the fix, so npm update minimatch --package-lock-only was sufficient to resolve them to 3.1.5 and 5.1.9 respectively.

@smithy/config-resolver

@smithy/config-resolver was a transitive dependency of @aws-sdk/client-secrets-manager and related SDK packages, pinned at 4.1.4 — below the patched floor of 4.4.0. The parent packages already declared ^4.1.4, meaning the fix was semver-compatible; bumping @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers to ^3.844.0 in package.json caused npm to resolve @smithy/config-resolver to a patched version, and the package no longer appears as a distinct lockfile entry in the updated tree.

ajv

ajv appeared in two lockfile locations. The aws-cdk-lib-nested copy (via table) was resolved to 8.20.0 (satisfying >=8.18.0) as a side-effect of the aws-cdk-lib parent bump. The root-hoisted 6.x copy (via eslint) sat at 6.12.6, below the patched floor of 6.14.0; since eslint@8.57.1 already declares ^6.12.4, the fix was semver-compatible and npm update ajv --package-lock-only resolved it to 6.15.0.

Version changes

Package	From	To	Why updated
`@aws-sdk/client-secrets-manager`	`^3.348.0` (3.840.0)	`^3.844.0` (3.1075.0)	Parent bump to fix `fast-xml-parser` and `@smithy/config-resolver` transitives
`@aws-sdk/credential-providers`	`^3.348.0` (3.840.0)	`^3.844.0` (3.1075.0)	Parent bump aligned with `client-secrets-manager`; same transitive chain
`aws-cdk-lib`	`^2.78.0` (2.204.0)	`^2.246.0` (2.260.0)	Direct CVE fix (CVE-2026-11417); also fixes nested `fast-uri`, `yaml`, `minimatch`, `brace-expansion`, `ajv@8.x`
`fast-xml-parser`	4.4.1	removed (resolved via `@aws-sdk/core@3.844.0+`)	Transitive fix after parent bump of `@aws-sdk/client-secrets-manager`
`fast-uri`	3.0.6	3.1.2	Transitive fix after `aws-cdk-lib` parent bump (nested under `ajv`)
`yaml`	1.10.2	1.10.3	Transitive fix after `aws-cdk-lib` parent bump (nested exact pin updated)
`minimatch` (root)	3.1.2	3.1.5	Lockfile refresh via `npm update`; semver-compatible with all declaring parents
`minimatch` (aws-cdk-lib nested)	3.1.2	10.2.5	Transitive after `aws-cdk-lib` parent bump
`minimatch` (filelist nested)	5.1.6	5.1.9	Lockfile refresh via `npm update`; semver-compatible with `filelist`
`brace-expansion` (root)	1.1.12	1.1.15	Transitive after `minimatch@3.x` lockfile refresh
`brace-expansion` (aws-cdk-lib nested)	1.1.12	5.0.6	Transitive after `aws-cdk-lib` parent bump
`brace-expansion` (filelist nested)	2.0.2	2.1.1	Transitive after `minimatch@5.x` lockfile refresh
`@smithy/config-resolver`	4.1.4	removed (resolved via updated SDK)	Transitive fix after parent bump of `@aws-sdk/client-secrets-manager`
`ajv` (root, 6.x)	6.12.6	6.15.0	Lockfile refresh via `npm update`; semver-compatible with `eslint`
`ajv` (aws-cdk-lib nested, 8.x)	8.17.1	8.20.0	Transitive after `aws-cdk-lib` parent bump (nested under `table`)

github-actions · 2026-06-30T23:25:58Z

Package lock diff

 2.4.1 -> 2.6.1
node_modules/@aws-cdk/asset-awscli-v1 2.2.242 -> 2.2.282
node_modules/@aws-cdk/asset-node-proxy-agent-v6 2.1.0 -> 2.1.2
node_modules/@aws-cdk/cloud-assembly-schema 45.2.0 -> 54.5.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema 1.4.1 -> 1.5.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/semver 7.7.2 -> 7.8.4
node_modules/@aws-sdk/client-cognito-identity 3.840.0 -> 3.1075.0
node_modules/@aws-sdk/client-secrets-manager 3.840.0 -> 3.1075.0
node_modules/@aws-sdk/client-sso removed
node_modules/@aws-sdk/core 3.840.0 -> 3.974.23
node_modules/@aws-sdk/credential-provider-cognito-identity 3.840.0 -> 3.972.48
node_modules/@aws-sdk/credential-provider-env 3.840.0 -> 3.972.49
node_modules/@aws-sdk/credential-provider-http 3.840.0 -> 3.972.51
node_modules/@aws-sdk/credential-provider-ini 3.840.0 -> 3.972.56
node_modules/@aws-sdk/credential-provider-node 3.840.0 -> 3.972.58
node_modules/@aws-sdk/credential-provider-process 3.840.0 -> 3.972.49
node_modules/@aws-sdk/credential-provider-sso 3.840.0 -> 3.972.55
node_modules/@aws-sdk/credential-provider-web-identity 3.840.0 -> 3.972.55
node_modules/@aws-sdk/credential-providers 3.840.0 -> 3.1075.0
node_modules/@aws-sdk/middleware-host-header removed
node_modules/@aws-sdk/middleware-logger removed
node_modules/@aws-sdk/middleware-recursion-detection removed
node_modules/@aws-sdk/middleware-user-agent removed
node_modules/@aws-sdk/nested-clients 3.840.0 -> 3.997.23
node_modules/@aws-sdk/region-config-resolver removed
node_modules/@aws-sdk/token-providers 3.840.0 -> 3.1074.0
node_modules/@aws-sdk/types 3.840.0 -> 3.973.13
node_modules/@aws-sdk/util-endpoints removed
node_modules/@aws-sdk/util-user-agent-browser removed
node_modules/@aws-sdk/util-user-agent-node removed
node_modules/@aws-sdk/xml-builder 3.821.0 -> 3.972.31
node_modules/@smithy/abort-controller removed
node_modules/@smithy/config-resolver removed
node_modules/@smithy/core 3.6.0 -> 3.26.0
node_modules/@smithy/credential-provider-imds 4.0.6 -> 4.4.2
node_modules/@smithy/fetch-http-handler 5.0.4 -> 5.5.2
node_modules/@smithy/hash-node removed
node_modules/@smithy/invalid-dependency removed
node_modules/@smithy/is-array-buffer removed
node_modules/@smithy/middleware-content-length removed
node_modules/@smithy/middleware-endpoint removed
node_modules/@smithy/middleware-retry removed
node_modules/@smithy/middleware-serde removed
node_modules/@smithy/middleware-stack removed
node_modules/@smithy/node-config-provider removed
node_modules/@smithy/node-http-handler 4.0.6 -> 4.8.2
node_modules/@smithy/property-provider removed
node_modules/@smithy/protocol-http removed
node_modules/@smithy/querystring-builder removed
node_modules/@smithy/querystring-parser removed
node_modules/@smithy/service-error-classification removed
node_modules/@smithy/shared-ini-file-loader removed
node_modules/@smithy/signature-v4 5.1.2 -> 5.5.2
node_modules/@smithy/smithy-client removed
node_modules/@smithy/types 4.3.1 -> 4.15.0
node_modules/@smithy/url-parser removed
node_modules/@smithy/util-base64 removed
node_modules/@smithy/util-body-length-browser removed
node_modules/@smithy/util-body-length-node removed
node_modules/@smithy/util-buffer-from removed
node_modules/@smithy/util-config-provider removed
node_modules/@smithy/util-defaults-mode-browser removed
node_modules/@smithy/util-defaults-mode-node removed
node_modules/@smithy/util-endpoints removed
node_modules/@smithy/util-hex-encoding removed
node_modules/@smithy/util-middleware removed
node_modules/@smithy/util-retry removed
node_modules/@smithy/util-stream removed
node_modules/@smithy/util-uri-escape removed
node_modules/@smithy/util-utf8 removed
node_modules/@types/uuid removed
node_modules/ajv 6.12.6 -> 6.15.0
node_modules/aws-cdk-lib 2.204.0 -> 2.260.0
node_modules/aws-cdk-lib/node_modules/ajv 8.17.1 -> 8.20.0
node_modules/aws-cdk-lib/node_modules/balanced-match 1.0.2 -> 4.0.4
node_modules/aws-cdk-lib/node_modules/brace-expansion 1.1.12 -> 5.0.6
node_modules/aws-cdk-lib/node_modules/concat-map removed
node_modules/aws-cdk-lib/node_modules/fast-uri 3.0.6 -> 3.1.2
node_modules/aws-cdk-lib/node_modules/fs-extra 11.3.0 -> 11.3.5
node_modules/aws-cdk-lib/node_modules/jsonfile 6.1.0 -> 6.2.1
node_modules/aws-cdk-lib/node_modules/minimatch 3.1.2 -> 10.2.5
node_modules/aws-cdk-lib/node_modules/semver 7.7.2 -> 7.8.1
node_modules/aws-cdk-lib/node_modules/yaml 1.10.2 -> 1.10.3
node_modules/bowser 2.11.0 -> 2.14.1
node_modules/brace-expansion 1.1.12 -> 1.1.15
node_modules/constructs 10.4.2 -> 10.6.0
node_modules/fast-xml-parser removed
node_modules/filelist/node_modules/brace-expansion 2.0.2 -> 2.1.1
node_modules/filelist/node_modules/minimatch 5.1.6 -> 5.1.9
node_modules/minimatch 3.1.2 -> 3.1.5
node_modules/strnum removed
node_modules/uuid removed
node_modules/@aws-crypto/crc32 added
node_modules/@aws-sdk/credential-provider-login added
node_modules/@aws-sdk/signature-v4-multi-region added
node_modules/@aws/lambda-invoke-store added
node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api added

aikido-autofix · 2026-07-02T23:31:49Z

Closed by Aikido: a new AutoFix has been created → #42

fix(security): update dependencies

dfce26f

aikido-autofix Bot mentioned this pull request Jun 30, 2026

[Aikido] Fix 17 security issues in fast-xml-parser, fast-uri, aws-cdk-lib and 5 more #40

Closed

aikido-autofix Bot closed this Jul 2, 2026

aikido-autofix Bot deleted the fix/aikido-security-update-packages-58317088-xmxi branch July 2, 2026 23:31

Navigation Menu

Uh oh!

[Aikido] Fix 17 security issues in fast-xml-parser, fast-uri, aws-cdk-lib and 5 more - #41

[Aikido] Fix 17 security issues in fast-xml-parser, fast-uri, aws-cdk-lib and 5 more#41
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-58317088-xmxi

aikido-autofix Bot commented Jun 30, 2026

Uh oh!

github-actions Bot commented Jun 30, 2026

Uh oh!

aikido-autofix Bot commented Jul 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

aikido-autofix Bot commented Jun 30, 2026

Short summary

fast-xml-parser

fast-uri

aws-cdk-lib

brace-expansion

yaml

minimatch

@smithy/config-resolver

ajv

Version changes

Uh oh!

github-actions Bot commented Jun 30, 2026

Package lock diff

Uh oh!

aikido-autofix Bot commented Jul 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants