Skip to content

[Aikido] Fix 22 security issues in fast-xml-parser, fast-uri, aws-cdk-lib and 6 more - #45

Closed
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-63724733-ia8f
Closed

[Aikido] Fix 22 security issues in fast-xml-parser, fast-uri, aws-cdk-lib and 6 more#45
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-63724733-ia8f

Conversation

@aikido-autofix

@aikido-autofix aikido-autofix Bot commented Jul 9, 2026

Copy link
Copy Markdown

Upgrade dependencies to fix critical XML entity injection XSS, XML entity expansion DoS attacks, stack overflow in XML builder, URI path normalization bypass, and other security vulnerabilities.

⚠️ Breaking changes analysis not available for: aws-cdk-lib, minimatch, ajv, fs-extra

✅ No breaking changes for: fast-xml-parser, fast-uri, brace-expansion, yaml, @smithy/config-resolver

✅ 22 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue Severity           Description 
CVE-2026-25896
 
🚨 CRITICAL
 [fast-xml-parser] A dot (.) in DOCTYPE entity names is treated as a regex wildcard, allowing attackers to shadow built-in XML entities with arbitrary values and bypass entity encoding. This leads to XSS when parsed output is rendered. 
CVE-2026-26278
 
HIGH
 [fast-xml-parser] XML entity expansion vulnerability allows attackers to cause denial of service by forcing unlimited entity expansion with minimal input, potentially freezing the application for extended periods. 
CVE-2026-27942
 
HIGH
 [fast-xml-parser] XML builder with preserveOrder:true causes stack overflow leading to denial of service when processing certain inputs. The application crashes due to improper recursion handling during XML construction. 
CVE-2026-33036
 
HIGH
 [fast-xml-parser] Numeric character references and standard XML entities bypass entity expansion limits, allowing attackers to cause XML entity expansion Denial of Service by forcing excessive memory allocation and CPU usage through crafted XML payloads. 
CVE-2026-33349
 
MEDIUM
 [fast-xml-parser] XML entity expansion vulnerability where setting maxEntityCount or maxEntitySize to 0 is bypassed due to JavaScript falsy checks, allowing attackers to cause denial of service through memory exhaustion. The vulnerability affects configurations explicitly set to restrict or disable entities. 
AIKIDO-2026-10784
 
HIGH
 [fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal. 
CVE-2026-6321
 
HIGH
 [fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs. 
CVE-2026-6322
 
HIGH
 [fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities. 
AIKIDO-2026-507986
 
HIGH
 [fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization. 
CVE-2026-11417
 
HIGH
 [aws-cdk-lib] OS command injection vulnerability in NodejsFunction local bundling pipeline allows arbitrary command execution if an attacker controls bundling properties like externalModules, define, loader, inject, or esbuildArgs through shell metacharacters injection. 
AIKIDO-2026-577363
 
HIGH
 [aws-cdk-lib] OS command injection vulnerability in Docker-based NodejsFunction bundling when using the nodeModules option allows attackers to inject shell commands through dependency version strings, leading to arbitrary code execution with the privileges of the CDK toolchain user. 
AIKIDO-2026-237551
 
MEDIUM
 [brace-expansion] A recursive expansion function computes unnecessary segments before early returns, causing exponential time complexity when processing consecutive non-expanding brace groups, enabling denial-of-service attacks through short malicious inputs that can stall processes or workers. 
CVE-2026-33750
 
LOW
 [brace-expansion] A brace pattern with zero step value causes an infinite loop, leading to denial of service through process hangs and excessive memory allocation. The vulnerability affects string expansion operations when malicious or malformed patterns are processed. 
AIKIDO-2026-10477
 
LOW
 [brace-expansion] A denial-of-service vulnerability allows attackers to craft malicious brace patterns with repeated numeric ranges that cause exponential expansion, consuming excessive CPU and memory until process failure. The fix introduces an optional maximum limit parameter to bound expansion work. 
CVE-2026-33532
 
MEDIUM
 [yaml] A stack overflow vulnerability in the YAML parser's node resolution phase allows attackers to trigger a RangeError via deeply nested YAML structures (~2-10 KB), potentially causing denial of service or process termination in applications that don't catch non-YAMLParseError exceptions. 
CVE-2026-26996
 
LOW
 [minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs. 
CVE-2026-27903
 
LOW
 [minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems. 
CVE-2026-27904
 
LOW
 [minimatch] Nested extglobs (*() and +()) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs. 
GHSA-6475-r3vj-m8vf
 
LOW
 [@smithy/config-resolver] An attacker with environment access could set an invalid region value, potentially routing AWS API calls to non-AWS hosts. A validation enhancement was added to prevent improper endpoint construction through region input validation. 
CVE-2025-69873
 
LOW
 [ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort. 
AIKIDO-2026-273849
 
LOW
 [ajv] A prototype pollution vulnerability allows attackers to bypass format validation when the $data option is enabled by using inherited property names like constructor or toString as format values, causing unexpected validation behavior or errors. 
AIKIDO-2026-57045
 
LOW
 [fs-extra] A symlink in the destination path allows bypassing self-subdirectory protection, causing copy/move operations to recurse infinitely into the source tree until resource exhaustion or path length limits are exceeded (DoS).
🤖 Remediation details

Fix multiple critical/high/medium/low severity vulnerabilities in transitive and direct dependencies

Short summary

This PR remediates security vulnerabilities in the following packages: fast-xml-parser, fast-uri, aws-cdk-lib, brace-expansion, yaml, minimatch, @smithy/config-resolver, ajv, and fs-extra. The fixes are applied via direct version spec bumps in the root package.json (for aws-cdk-lib, @aws-sdk/client-secrets-manager, and @aws-sdk/credential-providers) and via lockfile-only transitive resolution updates in package-lock.json.

fast-xml-parser

Previously pulled in as an exact-pinned transitive dependency of @aws-sdk/core at version 4.4.1. Bumping the direct dependencies @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers from ^3.348.0 to ^3.844.0 caused npm to resolve @aws-sdk/core to 3.974.29+, which no longer declares fast-xml-parser as a dependency at all — removing the vulnerable package from the tree entirely.

fast-uri

Was nested inside aws-cdk-lib/node_modules/ajv at version 3.0.6. Bumping aws-cdk-lib from ^2.78.0 to ^2.260.0 in package.json resolved aws-cdk-lib@2.261.0, which no longer nests a separate ajv copy with a fast-uri dependency, removing the vulnerable instance from the lockfile entirely.

aws-cdk-lib

A direct dependency in package.json, bumped from ^2.78.0 to ^2.260.0 (resolving to 2.261.0). This was required both to fix the CVEs attributed directly to aws-cdk-lib and to pull in patched versions of several bundled/nested transitive dependencies (yaml, minimatch, fast-uri, fs-extra) that are only resolvable by upgrading the parent itself.

brace-expansion

Present in three instances. The root 1.x instance (under minimatch@3.x) moved from 1.1.12 to 1.1.16 and the 2.x instance (under filelist/node_modules/minimatch@5.x) moved from 2.0.2 to 2.1.2 via npm update --package-lock-only, which was possible because both parent minimatch versions declare brace-expansion with a caret range that permits the patched versions. The 5.x instance nested inside aws-cdk-lib/node_modules/minimatch is marked inBundle: true (physically embedded in the aws-cdk-lib tarball) and could not be updated beyond 5.0.6 as 2.261.0 is the latest available aws-cdk-lib release.

yaml

Nested inside aws-cdk-lib/node_modules/ as an exact-pinned bundled dependency at 1.10.2. Bumping aws-cdk-lib to ^2.260.0 resolved 2.261.0, which bundles yaml@1.10.3, satisfying the patched version requirement.

minimatch

Present in three instances. The root 3.x instance moved from 3.1.2 to 3.1.5 and the filelist-nested 5.x instance moved from 5.1.6 to 5.1.9 via npm update --package-lock-only. The aws-cdk-lib-nested instance moved from 3.1.2 to 10.2.5 as a result of the aws-cdk-lib parent bump, which now bundles minimatch@10.2.5.

@smithy/config-resolver

Was a transitive dependency at 4.1.4, pulled in by @aws-sdk/client-secrets-manager and related AWS SDK packages. Bumping @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers to ^3.844.0 caused the entire AWS SDK package group to resolve to 3.1081.0, which no longer surfaces a separate @smithy/config-resolver instance in the lockfile (the version constraint is satisfied by the updated resolution).

ajv

The 6.x instance at 6.12.6 was a transitive dependency of eslint@8.57.1, which declares ajv: ^6.12.4. Since eslint was already at its latest 8.x release and the caret range permits 6.14.0+, running npm update ajv --package-lock-only was sufficient to move it to 6.15.0. The 8.x instance previously nested inside aws-cdk-lib/node_modules/table was removed as a result of the aws-cdk-lib parent bump.

fs-extra

Nested inside aws-cdk-lib/node_modules/ as a bundled dependency. The aws-cdk-lib bump to ^2.260.0 (resolving 2.261.0) was required because the prior version bundled fs-extra@11.3.0. The new version declares fs-extra: ^11.3.5 and bundles 11.3.5; 11.3.6 is the patched minimum but is physically embedded in the tarball and 2.261.0 is the latest available aws-cdk-lib release, so this instance remains at 11.3.5 — a partial fix limited by the bundled nature of the dependency.

Version changes

Package From To Why updated
aws-cdk-lib ^2.78.0 ^2.260.0 Direct CVE fix; also fixes nested transitive vulnerabilities
@aws-sdk/client-secrets-manager ^3.348.0 ^3.844.0 Parent bump to fix fast-xml-parser and @smithy/config-resolver transitives
@aws-sdk/credential-providers ^3.348.0 ^3.844.0 Aligned with client-secrets-manager bump; same parent chain
fast-xml-parser 4.4.1 removed Transitive removed after @aws-sdk/core parent bump
fast-uri 3.0.6 removed Transitive removed after aws-cdk-lib parent bump
@smithy/config-resolver 4.1.4 resolved/removed Transitive resolved after @aws-sdk/client-secrets-manager parent bump
ajv (6.x) 6.12.6 6.15.0 Lockfile-only transitive update under eslint
ajv (8.x, aws-cdk-lib nested) 8.17.1 removed Transitive removed after aws-cdk-lib parent bump
yaml (aws-cdk-lib nested) 1.10.2 1.10.3 Transitive after aws-cdk-lib parent bump
minimatch (root 3.x) 3.1.2 3.1.5 Lockfile-only transitive update
minimatch (filelist nested 5.x) 5.1.6 5.1.9 Lockfile-only transitive update
minimatch (aws-cdk-lib nested) 3.1.2 10.2.5 Transitive after aws-cdk-lib parent bump
brace-expansion (root 1.x) 1.1.12 1.1.16 Lockfile-only transitive update under minimatch@3.x
brace-expansion (filelist nested 2.x) 2.0.2 2.1.2 Lockfile-only transitive update under minimatch@5.x
brace-expansion (aws-cdk-lib nested 5.x) 5.0.6 5.0.6 Bundled in aws-cdk-lib tarball; partial fix only — no newer release available
fs-extra (aws-cdk-lib nested) 11.3.0 11.3.5 Transitive after aws-cdk-lib parent bump; partial fix — bundled, 11.3.6 not yet available in any release

@aikido-autofix aikido-autofix Bot mentioned this pull request Jul 9, 2026
Closed
@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown

Package lock diff

 2.4.1 -> 2.6.1
node_modules/@aws-cdk/asset-awscli-v1 2.2.242 -> 2.2.282
node_modules/@aws-cdk/asset-node-proxy-agent-v6 2.1.0 -> 2.1.2
node_modules/@aws-cdk/cloud-assembly-schema 45.2.0 -> 54.8.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema 1.4.1 -> 1.5.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/semver 7.7.2 -> 7.8.4
node_modules/@aws-crypto/sha256-browser removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/is-array-buffer removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-buffer-from removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-utf8 removed
node_modules/@aws-crypto/sha256-js removed
node_modules/@aws-crypto/supports-web-crypto removed
node_modules/@aws-crypto/util removed
node_modules/@aws-crypto/util/node_modules/@smithy/is-array-buffer removed
node_modules/@aws-crypto/util/node_modules/@smithy/util-buffer-from removed
node_modules/@aws-crypto/util/node_modules/@smithy/util-utf8 removed
node_modules/@aws-sdk/client-cognito-identity 3.840.0 -> 3.1081.0
node_modules/@aws-sdk/client-secrets-manager 3.840.0 -> 3.1081.0
node_modules/@aws-sdk/client-sso removed
node_modules/@aws-sdk/core 3.840.0 -> 3.974.29
node_modules/@aws-sdk/credential-provider-cognito-identity 3.840.0 -> 3.972.54
node_modules/@aws-sdk/credential-provider-env 3.840.0 -> 3.972.55
node_modules/@aws-sdk/credential-provider-http 3.840.0 -> 3.972.57
node_modules/@aws-sdk/credential-provider-ini 3.840.0 -> 3.972.62
node_modules/@aws-sdk/credential-provider-node 3.840.0 -> 3.972.64
node_modules/@aws-sdk/credential-provider-process 3.840.0 -> 3.972.55
node_modules/@aws-sdk/credential-provider-sso 3.840.0 -> 3.972.61
node_modules/@aws-sdk/credential-provider-web-identity 3.840.0 -> 3.972.61
node_modules/@aws-sdk/credential-providers 3.840.0 -> 3.1081.0
node_modules/@aws-sdk/middleware-host-header removed
node_modules/@aws-sdk/middleware-logger removed
node_modules/@aws-sdk/middleware-recursion-detection removed
node_modules/@aws-sdk/middleware-user-agent removed
node_modules/@aws-sdk/nested-clients 3.840.0 -> 3.997.29
node_modules/@aws-sdk/region-config-resolver removed
node_modules/@aws-sdk/token-providers 3.840.0 -> 3.1081.0
node_modules/@aws-sdk/types 3.840.0 -> 3.973.15
node_modules/@aws-sdk/util-endpoints removed
node_modules/@aws-sdk/util-locate-window removed
node_modules/@aws-sdk/util-user-agent-browser removed
node_modules/@aws-sdk/util-user-agent-node removed
node_modules/@aws-sdk/xml-builder 3.821.0 -> 3.972.33
node_modules/@smithy/abort-controller removed
node_modules/@smithy/config-resolver removed
node_modules/@smithy/core 3.6.0 -> 3.29.1
node_modules/@smithy/credential-provider-imds 4.0.6 -> 4.4.6
node_modules/@smithy/fetch-http-handler 5.0.4 -> 5.6.3
node_modules/@smithy/hash-node removed
node_modules/@smithy/invalid-dependency removed
node_modules/@smithy/is-array-buffer removed
node_modules/@smithy/middleware-content-length removed
node_modules/@smithy/middleware-endpoint removed
node_modules/@smithy/middleware-retry removed
node_modules/@smithy/middleware-serde removed
node_modules/@smithy/middleware-stack removed
node_modules/@smithy/node-config-provider removed
node_modules/@smithy/node-http-handler 4.0.6 -> 4.9.3
node_modules/@smithy/property-provider removed
node_modules/@smithy/protocol-http removed
node_modules/@smithy/querystring-builder removed
node_modules/@smithy/querystring-parser removed
node_modules/@smithy/service-error-classification removed
node_modules/@smithy/shared-ini-file-loader removed
node_modules/@smithy/signature-v4 5.1.2 -> 5.6.2
node_modules/@smithy/smithy-client removed
node_modules/@smithy/types 4.3.1 -> 4.15.1
node_modules/@smithy/url-parser removed
node_modules/@smithy/util-base64 removed
node_modules/@smithy/util-body-length-browser removed
node_modules/@smithy/util-body-length-node removed
node_modules/@smithy/util-buffer-from removed
node_modules/@smithy/util-config-provider removed
node_modules/@smithy/util-defaults-mode-browser removed
node_modules/@smithy/util-defaults-mode-node removed
node_modules/@smithy/util-endpoints removed
node_modules/@smithy/util-hex-encoding removed
node_modules/@smithy/util-middleware removed
node_modules/@smithy/util-retry removed
node_modules/@smithy/util-stream removed
node_modules/@smithy/util-uri-escape removed
node_modules/@smithy/util-utf8 removed
node_modules/@types/uuid removed
node_modules/ajv 6.12.6 -> 6.15.0
node_modules/aws-cdk-lib 2.204.0 -> 2.261.0
node_modules/aws-cdk-lib/node_modules/ajv removed
node_modules/aws-cdk-lib/node_modules/ansi-regex removed
node_modules/aws-cdk-lib/node_modules/ansi-styles removed
node_modules/aws-cdk-lib/node_modules/astral-regex removed
node_modules/aws-cdk-lib/node_modules/balanced-match 1.0.2 -> 4.0.4
node_modules/aws-cdk-lib/node_modules/brace-expansion 1.1.12 -> 5.0.6
node_modules/aws-cdk-lib/node_modules/color-convert removed
node_modules/aws-cdk-lib/node_modules/color-name removed
node_modules/aws-cdk-lib/node_modules/concat-map removed
node_modules/aws-cdk-lib/node_modules/emoji-regex removed
node_modules/aws-cdk-lib/node_modules/fast-deep-equal removed
node_modules/aws-cdk-lib/node_modules/fast-uri removed
node_modules/aws-cdk-lib/node_modules/fs-extra 11.3.0 -> 11.3.5
node_modules/aws-cdk-lib/node_modules/is-fullwidth-code-point removed
node_modules/aws-cdk-lib/node_modules/json-schema-traverse removed
node_modules/aws-cdk-lib/node_modules/jsonfile 6.1.0 -> 6.2.1
node_modules/aws-cdk-lib/node_modules/lodash.truncate removed
node_modules/aws-cdk-lib/node_modules/minimatch 3.1.2 -> 10.2.5
node_modules/aws-cdk-lib/node_modules/require-from-string removed
node_modules/aws-cdk-lib/node_modules/semver 7.7.2 -> 7.8.1
node_modules/aws-cdk-lib/node_modules/slice-ansi removed
node_modules/aws-cdk-lib/node_modules/string-width removed
node_modules/aws-cdk-lib/node_modules/strip-ansi removed
node_modules/aws-cdk-lib/node_modules/table removed
node_modules/aws-cdk-lib/node_modules/yaml 1.10.2 -> 1.10.3
node_modules/balanced-match removed
node_modules/bowser 2.11.0 -> 2.14.1
node_modules/brace-expansion removed
node_modules/constructs 10.4.2 -> 10.6.0
node_modules/fast-xml-parser removed
node_modules/filelist/node_modules/brace-expansion 2.0.2 -> 2.1.2
node_modules/filelist/node_modules/minimatch 5.1.6 -> 5.1.9
node_modules/minimatch 3.1.2 -> 3.1.5
node_modules/strnum removed
node_modules/uuid removed
node_modules/@aws-sdk/credential-provider-login added
node_modules/@aws-sdk/signature-v4-multi-region added
node_modules/@aws/lambda-invoke-store added
node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api added
node_modules/filelist/node_modules/balanced-match added
node_modules/minimatch/node_modules/balanced-match added
node_modules/minimatch/node_modules/brace-expansion added

@aikido-autofix

aikido-autofix Bot commented Jul 20, 2026

Copy link
Copy Markdown
Author

Closed by Aikido: a new AutoFix has been created → #46

@aikido-autofix aikido-autofix Bot closed this Jul 20, 2026
@aikido-autofix
aikido-autofix Bot deleted the fix/aikido-security-update-packages-63724733-ia8f branch July 20, 2026 23:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants