[Aikido] Fix 15 security issues in axios, undici

[aikido-autofix]

Overview

Jira ticket: https://typeform.atlassian.net/browse/<TICKET_ID>

Upgrade axios and undici to fix SSRF/proxy bypass, prototype pollution header injection, credential leakage on cross-origin redirects, and unsafe error serialization vulnerabilities.

Changes

🤖 Remediation details

Fix security vulnerabilities in axios and undici transitive dependencies

Short summary

This PR remediates multiple high- and medium-severity vulnerabilities in two transitive dependencies — axios and undici — within shared-actions/send-deployment-event. The fixes are applied via a resolutions entry and a lockfile refresh in shared-actions/send-deployment-event/package.json, with the resolved versions updated in shared-actions/send-deployment-event/yarn.lock.

axios

axios is pulled in transitively by analytics-node@6.2.0 (declared as ^0.27.2), which resolved to the vulnerable 0.27.2. The required fix floor is 1.18.0, but analytics-node@6.2.0 is the only published version of that package and it still pins axios@^0.27.2, making a parent bump impossible. A resolutions entry of "axios": "^1.18.0" was added to package.json as a last resort to override the transitive constraint, causing Yarn to resolve axios to 1.19.0 in the lockfile.

undici

undici is pulled in transitively by @actions/http-client@4.0.0 (declared as ^6.23.0), which had resolved to the vulnerable 6.24.1. The parent's existing range ^6.23.0 already permits patched versions, so no manifest change was needed — a yarn upgrade 'undici@^6.23.0' lockfile refresh was sufficient to advance the resolved version to 6.28.0, which satisfies the ≥6.26.0 fix requirement.

Version changes

Package	From	To	Why updated
axios	0.27.2	1.19.0	Transitive CVE fix via resolutions override (parent analytics-node@6.2.0 has no fix path)
undici	6.24.1	6.28.0	Transitive CVE fix via lockfile refresh (parent @actions/http-client@4.0.0 range ^6.23.0 already permitted patched version)

Testing

Docs

• Yes! ✋ I have updated the documentation.

Security Impact — CVE vulnerabilities fixed by this PR

✅ 15 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2025-62718	HIGH	[axios] Improper hostname normalization in NO_PROXY rule checking allows requests to loopback addresses (localhost., [::1]) to bypass proxy protections, enabling proxy bypass and potential SSRF attacks against internal services. This vulnerability permits attackers to reach sensitive services despite configured NO_PROXY protections.
AIKIDO-2026-10741	HIGH	[axios] An HTTP client vulnerability allows prototype pollution through loose object merging, sensitive data exposure via error serialization, and improper proxy/socket handling that could lead to information disclosure or unauthorized access.
CVE-2026-40175	HIGH	[axios] A prototype pollution vulnerability in a third-party dependency can be exploited to inject unsanitized header values into outbound HTTP requests. This allows attackers to manipulate request headers, potentially leading to request smuggling, cache poisoning, or other header-based attacks.
AIKIDO-2026-291630	HIGH	[axios] Cross-origin redirects leak custom credential headers like X-API-Key and AWS tokens to unintended hosts, allowing attackers to steal sensitive authentication data. This information disclosure vulnerability affects shared environments where secret headers are set by default.
AIKIDO-2026-10509	HIGH	[axios] Prototype pollution vulnerability allows attackers to inject malicious headers into requests through unsafe FormData detection and header merging, potentially enabling authorization bypass or request manipulation.
CVE-2023-45857	MEDIUM	[axios] An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
CVE-2026-25639	MEDIUM	[axios] The mergeConfig function crashes with a TypeError when processing configuration objects containing proto as an own property, allowing attackers to trigger denial of service. An attacker can exploit this by providing a malicious configuration object created via JSON.parse().
GHSA-7q8q-rj6j-mhjq	MEDIUM	[axios] Prototype pollution in nested request options allows inherited Object.prototype properties to inject malicious Authorization headers and manipulate query strings when applications pass placeholder objects like auth: {} or paramsSerializer: {}. This enables credential exfiltration and request tampering when another component has already polluted the prototype chain.
GHSA-mmx7-hfxf-jppx	MEDIUM	[axios] Prototype pollution read-side gadgets in axios allow attackers who pollute Object.prototype to hijack requests by injecting malicious data, proxy settings, or parameter serializers into bodyless methods and low-level adapter calls. This can result in credential theft, request body injection, traffic redirection, or URL manipulation depending on the attack vector.
AIKIDO-2025-10185	MEDIUM	[axios] A server-side request forgery (SSRF) vulnerability exists due to allowAbsoluteUrls not being set to false by default in buildFullPath(), allowing attackers to bypass URL restrictions and process unintended URLs.
AIKIDO-2026-38469	MEDIUM	[axios] Malformed HTTP/HTTPS URLs without // (e.g., https:internal.example) were silently normalized instead of rejected, allowing attackers to bypass URL allowlists or WAF checks and reach unintended hosts. The fix now throws an error for invalid scheme URLs before normalization.
CVE-2025-27152	MEDIUM	[axios] Axios sends requests to absolute URLs even when baseURL is configured, bypassing intended routing and potentially causing Server-Side Request Forgery (SSRF) and credential leakage in both server and client environments.
AIKIDO-2023-10001	LOW	[axios] Prototype pollution vulnerability in the formDataToJSON function allows attackers to manipulate object properties. Additionally, a ReDoS vulnerability in combineURLs can cause denial of service through malicious input.
AIKIDO-2026-145478	HIGH	[undici] WebSocket client fails to limit the number of message fragments, allowing a malicious server to send unlimited continuation frames that bypass payload size checks and cause unbounded memory growth, leading to denial of service through memory exhaustion.
AIKIDO-2026-48713	MEDIUM	[undici] The Set-Cookie parser incorrectly percent-decodes cookie values, allowing encoded sequences like %0D%0A to become literal bytes. This enables HTTP response header injection attacks (session fixation, open redirect, cache poisoning) when parsed values are forwarded to response headers.

Breaking Changes & Upgrade Impact

⚠️ Incomplete breaking changes analysis (1/2 analyzed)

⚠️ Breaking changes analysis not available for: axios

✅ No breaking changes from the axios upgrade (0.27.2 => 1.18.0) affect this codebase.

The codebase uses axios indirectly through the analytics-node library (v6.2.0), which creates an axios instance and makes POST requests with complete URLs. The code does not:

• Use baseURL configuration with relative URLs (so the v1.8.0 URL combination change doesn't apply)

• Use deprecated features like CancelToken, axios.Cancel, axios.isCancel, axios.all(), or axios.spread()

• Implement custom interceptors, transformers, or adapters that might be affected by internal API changes

• Rely on any specific error handling behavior that changed in v1.0.0

The axios-retry library (v3.2.0) used by analytics-node is compatible with axios 1.x. The upgrade should be safe to proceed.

All breaking changes by upgrading undici from version 6.24.1 to 6.28.0 (CHANGELOG)

Version	Description
6.27.0	WebSocket fragment count limit enforced - applications using WebSocket against untrusted endpoints will now reject messages with excessive fragment counts that previously would have been accepted (though this caused DoS)
6.27.0	Set-Cookie percent-decoding removed - parseSetCookie no longer applies percent-decoding to cookie values, changing behavior for cookies containing encoded sequences like %0D%0A and %00
6.27.0	SameSite attribute parsing strictness - cookie parser now requires exact matches for SameSite values (Strict, Lax, None) rather than accepting them as substrings, rejecting previously accepted values like SameSite=NoneOfYourBusiness
6.27.0	Idle socket validation changes - keep-alive socket reuse behavior modified to prevent response queue poisoning, potentially affecting applications relying on previous socket reuse timing
6.28.0	Content-Length validation on partial responses - retry interceptor now rejects partial responses whose Content-Length is inconsistent with Content-Range, where previously inconsistent responses may have been accepted
6.28.0	Cookie domain, path, and unparsed attribute validation - setCookie() now applies stricter validation that may reject previously accepted unsanitized domain and unparsed values
6.28.0	Blob-like request body type property validation - malicious or invalid type properties on duck-typed blob-like HTTP/1.1 request bodies are now coerced and validated, potentially rejecting previously accepted values

For contributions to the Typeform/.github repo

Note: Please do not use this repository for new internal shared workflows and actions. Use https://github.com/Typeform/.github-private instead!

Please check that your contribution applies to one of these cases below. If this is not the case, please contribute to https://github.com/Typeform/.github-private instead.

• This PR only changes an existing workflow.
• This PR adds a new workflow that is needed in a public Typeform repository.

[gitstream-cm]

🚨 gitStream Monthly Automation Limit Reached 🚨

Your organization has exceeded the number of pull requests allowed for automation with gitStream.
Monthly PRs automated: 250/250

To continue automating your PR workflows and unlock additional features, please contact LinearB.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 2
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page