[aikido-autofix]

AI AutoFix

These PRs will require human vetting and potentially some fixes to fully integrate with the codebase.

Upgrade undici to fix critical vulnerabilities: TLS callback stripping in BalancedPool and Agent (CVE-2026-84961, CVE-2026-109383) enabling certificate bypass, and cache poisoning via cross-origin redirects (CVE-2026-109829).

✅ There are no breaking changes

✅ 37 CVEs resolved by this upgrade, including 3 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-84961	🚨 CRITICAL	[undici] BalancedPool's JSON serialization of options silently discards function-valued TLS callbacks like checkServerIdentity, allowing rejection of certificates that should be blocked by custom validation logic. This enables TLS certificate validation bypass when using BalancedPool with custom security callbacks.
CVE-2026-109383	🚨 CRITICAL	[undici] A JSON-based deep clone in the Agent dispatcher silently drops custom TLS verification callbacks (like checkServerIdentity), allowing certificates that should be rejected to be silently accepted. This bypasses custom certificate validation and public-key pinning protections.
CVE-2026-109829	🚨 CRITICAL	[undici] undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redire...
CVE-2026-84933	HIGH	[undici] undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marke...
AIKIDO-2026-775839	HIGH	[undici] The WebSocket client throws an uncaught TypeError during the opening handshake when a 101 response includes a Sec-WebSocket-Protocol header that the client never requested. The throw runs inside a queueMicrotask with no surrounding error handling, so it terminates the Node.js pro...
CVE-2026-19534	HIGH	[undici] undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol head...
CVE-2026-85014	HIGH	[undici] undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the retur...
AIKIDO-2026-393834	HIGH	[undici] A malicious or compromised HTTPS server can crash the Node.js client process by performing a TLS 1.2 renegotiation after the connection is established and presenting a different, CA-trusted certificate whose hostname does not match the requested host. Node.js destroys the socket with `ER...
CVE-2026-109869	HIGH	[undici] undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connectio...
CVE-2026-109841	HIGH	[undici] undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token b...
CVE-2026-109924	HIGH	[undici] undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data...
CVE-2026-87018	HIGH	[undici] undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostnam...
CVE-2026-109932	HIGH	[undici] undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket serve...
CVE-2026-87029	HIGH	[undici] undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and w...
AIKIDO-2026-559286	HIGH	[undici] BalancedPool deep-clones constructor options with JSON, which silently drops function-valued connect and tls options such as a caller-supplied checkServerIdentity. A certificate the application was written to reject is then accepted if it still passes Node's default hostname and ...
AIKIDO-2026-846025	HIGH	[undici] Agent deep-clones its constructor options with JSON before forwarding them to each per-origin Pool, which silently drops function-valued tls options such as a caller-supplied checkServerIdentity. A certificate the application was written to reject (e.g. for certificate or public-...
AIKIDO-2026-159850	HIGH	[undici] A malicious HTTP server can crash the Node.js process by returning a response with more than five content codings and closing the connection before sending the body. fetch() rejects such responses, but the internal response stream is created before the content-encoding limit check and ...
AIKIDO-2026-740957	MEDIUM	[undici] When an originless Agent composes the interceptors as compose(redirect(), cache()) with a shared cache, the cache key is built from the original request URL before the redirect handler changes the origin. The response produced after a cross-origin redirect is then stored under the or...
AIKIDO-2026-426351	MEDIUM	[undici] The cache interceptor in shared mode, the default, stores and replays responses that carry Set-Cookie. A later caller that hits the same cache key receives another caller's cookie, and an untrusted upstream can inject cookies into cached responses served to every subsequent caller. P...
AIKIDO-2026-643359	MEDIUM	[undici] The retry handler leaves an already-exposed response body pending when a truncated successful response is retried and the retry returns a non-retryable status. The original body the application still holds is never ended or destroyed, so reads hang and bodyTimeout does not fire. A remo...
AIKIDO-2026-891074	MEDIUM	[undici] WebSocketStream aborts its locked writable on an unclean TCP close and discards the rejection. Aborting a locked writable rejects with a TypeError, and the unobserved rejection terminates the process under Node.js's default unhandledRejection behavior. A remote peer can trigger thi...
AIKIDO-2026-687335	MEDIUM	[undici] The WebSocket permessage-deflate size-limit cleanup removes every listener from the internal zlib inflate stream, including its error listener, while that stream can still emit. A compressed message that crosses the decompressed-payload limit and then contains a malformed DEFLATE byte em...
AIKIDO-2026-633281	MEDIUM	[undici] The decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header and caps the number of layers but not the total decompressed output size. A small compressed payload can expand without bound in client memory and stall or crash the process. Th...
CVE-2026-85024	MEDIUM	[undici] undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decom...
CVE-2026-18149	MEDIUM	[undici] undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryab...
CVE-2026-84890	MEDIUM	[undici] undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty ...
AIKIDO-2026-634008	MEDIUM	[undici] The decompress interceptor forwards decompressed data to the downstream handler from asynchronous zlib stream callbacks without catching exceptions. If the downstream handler throws, for example the dump interceptor when a response exceeds its maxSize, the exception escapes as an u...
AIKIDO-2026-609286	MEDIUM	[undici] The undici EventSource client retains unbounded parser state when receiving data from a Server-Sent Events peer. A malicious or compromised server can send millions of tiny completed data: fields without a blank event separator, or a single unfinished line split across many chunks,...
AIKIDO-2026-559914	MEDIUM	[undici] fetch() verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, while the SRI specification treats tokens case-insensitively. A valid uppercase or mixed-case token such as SHA256-... is treated as unknown and skipped, so the integrity ...
CVE-2026-84947	MEDIUM	[undici] undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals co...
CVE-2026-85008	MEDIUM	[undici] undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls thro...
AIKIDO-2026-54683	MEDIUM	[undici] parseUnparsedAttributes in lib/web/cookies/parse.js recursed once per Set-Cookie attribute with no depth bound. A single response header of the form a=b;;;;... overflowed the JavaScript call stack and threw an uncaught RangeError: Maximum call stack size exceeded out of `getSet...
AIKIDO-2026-64244	MEDIUM	[undici] The WebSocket client in undici, including Node.js's bundled globalThis.WebSocket, automatically writes a PONG response for every PING frame it receives and ignores the false return value of socket.write(), which signals backpressure. A malicious or compromised WebSocket server ca...
AIKIDO-2026-968357	LOW	[undici] The cache interceptor is documented to cache only safe HTTP methods, but its skip list is built by subtracting configured methods from the safe-method set, so POST, PUT, PATCH, and DELETE still hit the cache. Combined with a storage gate that does not check the method, a cachea...
AIKIDO-2026-56238	LOW	[undici] The dump interceptor discards a response body up to maxSize. For a chunked response with no Content-Length, it signals completion once that size is reached instead of aborting, then a second completion from the parser tears down the connection. The application observes a successful...
AIKIDO-2026-253444	LOW	[undici] The retry interceptor can append resumed response bytes to a body already delivered, causing the actual body to exceed the Content-Length header, allowing a proxy to emit excess bytes that downstream peers interpret as a separate HTTP response (HTTP response smuggling).
CVE-2026-18540	LOW	[undici] A retry interceptor vulnerability allows response bodies from ranged retries to be appended to earlier partial responses while preserving original headers, causing the body to exceed the stated Content-Length and enabling HTTP response splitting or desynchronization attacks when forwarded downstream.

🤖 Remediation details

Update undici override floor to 7.30.1 to remediate multiple security advisories

Short summary

This PR remediates a large set of security vulnerabilities in the transitive dependency undici. The fix is applied in the root package.json (override selector update) and reflected in package-lock.json. No workspace member manifests were changed.

undici

undici is pulled in transitively by @actions/github (v9.1.1) and both copies of @actions/http-client (v3.0.2 and v4.0.1), all of which declare undici at ^6.23.0 — a range that can never resolve to the required 7.x fix line. Because no published version of any parent bumps its undici range into 7.x, a parent bump cannot reach the patched version, making an override the only viable mechanism. The root package.json already contained an override "undici@<7.29.0": "7.29.0" from a prior fix; this PR advances that selector and target to "undici@<7.30.1": "7.30.1", which is the minimum version that satisfies every advisory in this batch. Running npm install --package-lock-only resolved the single hoisted undici instance from 7.29.0 to 7.30.1.

Version changes

Package	From	To	Why updated
undici	7.29.0	7.30.1	Override floor advanced to patched version; resolves all listed security advisories