[Aikido] Fix 13 security issues in axios, undici

[aikido-autofix]

Overview

Jira ticket: https://typeform.atlassian.net/browse/<TICKET_ID>

Upgrade axios and undici to fix SSRF/proxy bypass, prototype pollution header injection, credential leakage on cross-origin redirects, and unsafe error serialization vulnerabilities. This update includes breaking changes that require manual migration.

Changes

Testing

Security Impact — CVE vulnerabilities fixed by this PR

✅ 13 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2025-62718	HIGH	[axios] Improper hostname normalization in NO_PROXY rule checking allows requests to loopback addresses (localhost., [::1]) to bypass proxy protections, enabling proxy bypass and potential SSRF attacks against internal services. This vulnerability permits attackers to reach sensitive services despite configured NO_PROXY protections.
AIKIDO-2026-10741	HIGH	[axios] HTTP client vulnerability allowing prototype pollution through loose object merging, sensitive data exposure via error serialization, and improper proxy/socket handling that could lead to information disclosure or unauthorized access.
CVE-2026-40175	HIGH	[axios] A prototype pollution vulnerability in a third-party dependency can be exploited to inject unsanitized header values into outbound HTTP requests. This could allow attackers to manipulate request headers for potential information disclosure or request forgery attacks.
AIKIDO-2026-291630	HIGH	[axios] HTTP adapter fails to strip custom credential headers (like X-API-Key) during cross-origin redirects, potentially leaking API keys and authentication tokens to unintended hosts. This information disclosure vulnerability affects shared environments where secret headers are set by default.
AIKIDO-2026-10509	HIGH	[axios] Prototype pollution vulnerability allows attackers to inject malicious headers into requests through unsafe FormData detection and header merging, potentially enabling authorization bypass or request manipulation.
CVE-2023-45857	MEDIUM	[axios] An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
CVE-2026-25639	MEDIUM	[axios] The mergeConfig function crashes with a TypeError when processing configuration objects containing proto as an own property, allowing attackers to trigger denial of service. An attacker can exploit this by providing a malicious configuration object created via JSON.parse().
AIKIDO-2025-10185	MEDIUM	[axios] A server-side request forgery (SSRF) vulnerability exists due to allowAbsoluteUrls not being set to false by default in buildFullPath(), allowing attackers to bypass URL restrictions and process unintended URLs.
AIKIDO-2026-38469	MEDIUM	[axios] Accepts malformed HTTP/HTTPS URLs without // (e.g., https:internal.example), allowing attackers to bypass URL allowlists or WAF checks and reach unintended hosts. The vulnerability enables URL validation bypass through silent normalization of invalid URLs.
CVE-2025-27152	MEDIUM	[axios] Axios sends requests to absolute URLs even when baseURL is configured, bypassing intended routing and potentially causing Server-Side Request Forgery (SSRF) and credential leakage in both server and client environments.
AIKIDO-2023-10001	LOW	[axios] Prototype pollution vulnerability in the formDataToJSON function allows attackers to modify object prototypes. Additionally, a ReDoS vulnerability in combineURLs can cause denial of service through malicious input.
AIKIDO-2026-145478	HIGH	[undici] WebSocket client fails to limit the number of message fragments, allowing a malicious server to send unlimited continuation frames that bypass payload size checks and cause unbounded memory growth, leading to denial of service.
AIKIDO-2026-48713	MEDIUM	[undici] The Set-Cookie parser incorrectly percent-decodes cookie values, allowing encoded sequences like %0D%0A to become literal bytes. This enables HTTP response header injection attacks (session fixation, open redirect, cache poisoning) when parsed values are forwarded to response headers.

Breaking Changes & Upgrade Impact

⚠️ Incomplete breaking changes analysis (1/2 analyzed)

⚠️ Breaking changes analysis not available for: axios

⚠️ The axios upgrade from 0.27.2 to 1.18.0 (resolved to 1.20.0) creates a version incompatibility with the analytics-node dependency.

Where your code is affected:

• shared-actions/send-deployment-event/package.json (line 10): Direct axios dependency "axios": "^1.18.0"

• shared-actions/send-deployment-event/deployment-frequency-event.js (line 2, 12-20): Uses analytics-node@6.2.0 which depends on axios@^0.27.2

• shared-actions/send-deployment-event/yarn.lock (line showing axios resolution): Yarn resolves to axios@1.20.0 which breaks the ^0.27.2 semver range required by analytics-node@6.2.0

Impact:

The analytics-node@6.2.0 library and its dependency axios-retry@3.2.0 were designed for axios 0.27.x. Installing axios 1.20.0 violates the semver constraint ^0.27.2 (which means >=0.27.2 <1.0.0). This will cause analytics-node to receive an incompatible major version of axios, potentially breaking HTTP requests, retry logic, error handling, and request/response interceptors used internally by the library.

Remediation:

Either downgrade axios to ^0.27.2 to match the analytics-node dependency, or upgrade analytics-node to a version that supports axios 1.x (check for analytics-node versions >= 7.x that may support axios 1.x).

All breaking changes by upgrading undici from version 6.24.1 to 6.28.0 (CHANGELOG)

Version	Description
6.27.0	WebSocket fragment count limit enforced - applications using WebSocket against untrusted endpoints will now reject messages with excessive fragment counts that previously would have been accepted (though this caused DoS)
6.27.0	Set-Cookie percent-decoding removed - parseSetCookie no longer applies percent-decoding to cookie values, changing behavior for cookies containing encoded sequences like %0D%0A and %00
6.27.0	SameSite attribute parsing strictness - cookie parser now requires exact matches for SameSite values (Strict, Lax, None) rather than accepting them as substrings, rejecting previously accepted values like SameSite=NoneOfYourBusiness
6.27.0	Idle socket validation changes - keep-alive socket reuse behavior modified to prevent response queue poisoning, potentially affecting applications relying on previous socket reuse timing
6.28.0	Content-Length validation on partial responses - retry interceptor now rejects partial responses whose Content-Length is inconsistent with Content-Range, where previously inconsistent responses may have been accepted
6.28.0	Cookie domain, path, and unparsed attribute validation - setCookie() now applies stricter validation that may reject previously accepted unsanitized domain and unparsed values
6.28.0	Blob-like request body type property validation - malicious or invalid type properties on duck-typed blob-like HTTP/1.1 request bodies are now coerced and validated, potentially rejecting previously accepted values

Fix Details / Technical Implementation

🤖 Remediation details

Fix security vulnerabilities in axios and undici (shared-actions/send-deployment-event)

Short summary

This PR remediates multiple high- and medium-severity vulnerabilities in two packages — axios and undici — used by the shared-actions/send-deployment-event action. Changes touch shared-actions/send-deployment-event/package.json (new direct dependency entry and a resolutions field) and the corresponding yarn.lock.

axios

axios was a transitive dependency pulled in by the direct dependency analytics-node@6.2.0, which declares axios@^0.27.2. Because ^0.27.2 cannot resolve across the major boundary to the required ≥1.18.0, and analytics-node@6.2.0 is the latest published version with no fix available, two additions were required: axios: "^1.18.0" was added as a direct dependency in package.json, and a resolutions: { "axios": "^1.18.0" } field was added to force Yarn Classic to resolve the analytics-node transitive selector to the same patched version. Both selectors (^0.27.2 and ^1.18.0) now merge into a single lockfile entry resolving to 1.20.0.

undici

undici is a transitive dependency pulled in by @actions/http-client@4.0.0 via ^6.23.0. That range already admits 6.26.0+, so no manifest change was needed — a lockfile refresh via yarn upgrade 'undici@^6.23.0' was sufficient to advance the resolved version from 6.24.1 to 6.28.0, satisfying the ≥6.26.0 patch floor.

Version changes

Package	From	To	Why updated
axios	0.27.2 (resolved)	1.20.0 (resolved)	Direct CVE fix; direct dep + resolution added to override transitive ^0.27.2 from analytics-node
undici	6.24.1 (resolved)	6.28.0 (resolved)	Direct CVE fix; lockfile refresh only — parent range ^6.23.0 already admitted patched version

Docs

• Yes! ✋ I have updated the documentation.

For contributions to the Typeform/.github repo

Note: Please do not use this repository for new internal shared workflows and actions. Use https://github.com/Typeform/.github-private instead!

Please check that your contribution applies to one of these cases below. If this is not the case, please contribute to https://github.com/Typeform/.github-private instead.

• This PR only changes an existing workflow.
• This PR adds a new workflow that is needed in a public Typeform repository.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 2
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page