fix(sec-auto): aikido Fix 13 security issues in undici, @fastify/busboy

[aikido-autofix]

AI AutoFix

These PRs will require human vetting and potentially some fixes to fully integrate with the codebase.

Upgrade undici and @fastify/busboy to fix HTTP request smuggling, WebSocket decompression DoS, and header parsing vulnerabilities.

✅ Code not affected by breaking changes.

✅ No breaking changes from the undici upgrade affect this codebase.

The codebase does not directly import or use undici. The package is only used as a transitive dependency through @actions/github (version 8.0.1), which internally uses undici 6.27.0 (not the version being upgraded).

Key findings:

• No direct imports of undici in the source code (src/ directory)

• No usage of throwOnError option in the codebase

• No usage of interceptors (searched for interceptor, createRedirectInterceptor, kInterceptors)

• No usage of the deduplicate interceptor

• The codebase requires Node.js >=24, which is well above the dropped Node.js v18 support in undici 7.0.0

• The only "deduplicate" reference found is in application logic for deduplicating GitHub check runs by name, which is unrelated to undici's deduplicate interceptor

The undici upgrade would only affect this codebase if @actions/github or @actions/http-client upgrade their undici dependency to version 7.x, which is a separate concern.

All breaking changes by upgrading undici from version 5.29.0 to 6.27.0 (CHANGELOG)

Version	Description
6.0.0	Node.js 16 support dropped (referenced by "16 eol" PR #2480)
6.14.0	Dropped Node.js support for versions < v18.17.0

✅ 13 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-1525	🚨 CRITICAL	[undici] Duplicate HTTP Content-Length headers with case-variant names are allowed, creating malformed requests that can cause denial of service or enable HTTP request smuggling attacks in inconsistent header interpretation scenarios.
CVE-2026-1526	HIGH	[undici] A malicious WebSocket server can send compressed frames that expand to extremely large sizes in memory without limits, causing denial-of-service through memory exhaustion and process crash. The vulnerability stems from unbounded decompression in the permessage-deflate extension without size validation.
CVE-2026-2229	HIGH	[undici] A malicious WebSocket server can crash the client process by sending an invalid server_max_window_bits parameter in the permessage-deflate extension, causing an uncaught RangeError when creating a zlib decompressor with an out-of-range value.
CVE-2026-22036	HIGH	[undici] An unbounded decompression chain vulnerability allows a malicious server to insert thousands of compression steps, causing excessive CPU usage and memory allocation. This results in denial of service through resource exhaustion.
AIKIDO-2024-10065	MEDIUM	[undici] Affected versions of the undici library are vulnerable to memory leaks. By making multiple fetch requests with the same AbortSignal, undici adds event listeners without removing them, leading to excessive memory consumption.
CVE-2026-9679	MEDIUM	[undici] The cookie parser incorrectly percent-decodes cookie values, allowing encoded sequences like %0D%0A to become literal bytes that enable HTTP response header injection. This permits attackers to inject arbitrary headers (Set-Cookie, Location, Cache-Control) into downstream responses, causing session fixation, open redirects, or cache poisoning in applications that forward parsed cookies to response headers.
AIKIDO-2026-10022	MEDIUM	[undici] A malicious server can send HTTP responses with excessive layered Content-Encoding headers, forcing the client into recursive decompression that exhausts CPU and memory resources, causing denial-of-service. This was mitigated by limiting the encoding chain to a maximum of 5 layers.
CVE-2026-1527	MEDIUM	[undici] HTTP request smuggling vulnerability allowing CRLF injection through the upgrade option, enabling arbitrary header injection and premature request termination to smuggle data to non-HTTP services.
CVE-2026-11525	LOW	[undici] Set-Cookie header parsing accepts non-spec SameSite values containing substrings like "Strict" or "None" instead of exact matches, allowing malicious servers to downgrade cookie security policies. This enables attackers to weaken SameSite enforcement through substring matching exploitation.
CVE-2026-6733	LOW	[undici] HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets, allowing an attacker-controlled upstream server to inject unsolicited responses that get associated with subsequent requests, causing responses to be delivered to wrong requests.
AIKIDO-2026-10369	LOW	[undici] Prototype pollution vulnerability allows attackers to modify object prototypes through specially crafted input with keys like __proto__ or constructor, potentially influencing application behavior or enabling further attacks.
AIKIDO-2026-10385	LOW	[undici] A prototype pollution vulnerability allows attackers to inject special keys like __proto__, constructor, or prototype into internal objects, potentially modifying the prototype chain and influencing application behavior or enabling further attacks.
AIKIDO-2025-10564	MEDIUM	[@fastify/busboy] Improper parsing of quoted filename parameters allows attackers to bypass file extension validation by appending forbidden extensions outside closing quotes, potentially enabling malicious script execution or XSS attacks.

🤖 Remediation details

Fix transitive undici and @fastify/busboy vulnerabilities via parent dependency bumps

Short summary

This PR remediates multiple critical, high, medium, and low severity vulnerabilities in the transitive dependencies undici and @fastify/busboy. Both packages entered the tree through the @actions/core and @actions/github dependency chains. Fixes are applied by bumping the two direct dependencies in the root package.json, with the updated resolutions reflected in package-lock.json.

undici

undici was resolved at 5.29.0 as a transitive dependency pulled in by two parent chains: @actions/github → @actions/http-client → undici, and @actions/core → @actions/http-client → undici. Version 5.29.0 is below the patched floor of 6.27.0 required to address all listed advisories. Because undici is not a direct dependency, the fix required bumping both owning parents: @actions/github was raised from ^6.0.0 to ^8.0.1 (the first release declaring undici@^6.23.0, which resolves to ≥6.27.0), and @actions/core was raised from ^1.10.1 to ^2.0.0 (the first release declaring @actions/http-client@^3.0.0, which in turn declares undici@^6.23.0). After both manifest edits and a lockfile refresh, undici consolidates to a single hoisted instance at 6.27.0.

@fastify/busboy

@fastify/busboy was resolved at 2.1.1 as a transitive dependency of undici@5.29.0, which declared it as ^2.0.0. Version 2.1.1 falls within the vulnerable range [1.0.0, 3.1.1] requiring a patched version of ≥3.2.0. Because @fastify/busboy is not a direct dependency and its presence was entirely a consequence of the old undici@5.x requiring it, bumping undici to 6.27.0 (via the parent bumps described above) removes @fastify/busboy from the dependency tree entirely — undici@6.x no longer depends on it.

Version changes

Package	From	To	Why updated
@actions/core	^1.10.1 → 1.11.1 resolved	^2.0.0 → 2.0.3 resolved	Direct dep bump required to pull in @actions/http-client@^3.0.0 and transitively fix undici
@actions/github	^6.0.0 → 6.0.1 resolved	^8.0.1 → 8.0.1 resolved	Direct dep bump required to pull in @actions/http-client@^3.0.2 and transitively fix undici
@actions/http-client	2.2.3	3.0.2	Transitive after parent bump (@actions/core and @actions/github); declares undici@^6.23.0
undici	5.29.0	6.27.0	Vulnerable package; resolved transitively after parent bumps to @actions/core and @actions/github
@fastify/busboy	2.1.1	removed	Vulnerable package; no longer a dependency of undici@6.x after parent bumps

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #147