fix(security): fix 16 security issues in axios, undici

[aikido-autofix]

Overview

Jira ticket: https://typeform.atlassian.net/browse/<TICKET_ID>

Upgrade axios and undici to fix SSRF/proxy bypass, prototype pollution header injection, credential leakage on cross-origin redirects, and unsafe error serialization vulnerabilities.

Changes

🤖 Remediation details

Fix security vulnerabilities in axios and undici transitive dependencies

Short summary

This PR remediates high- and medium-severity vulnerabilities in two transitive dependencies — axios and undici — within shared-actions/send-deployment-event. Changes touch shared-actions/send-deployment-event/package.json (new direct axios entry and a resolutions field) and the corresponding yarn.lock.

axios

axios was pulled in transitively by analytics-node@6.2.0 via a ^0.27.2 range, resolving to the vulnerable 0.27.2. Because analytics-node@6.2.0 is the latest published release and still declares axios@^0.27.2 (a 0.x range that cannot satisfy the required ^1.18.0 floor), no parent bump was available to pull in a patched version. As a result, axios@^1.18.0 was added as a direct dependency in package.json, and a resolutions: { "axios": "^1.18.0" } field was added to force Yarn Classic to collapse analytics-node's nested axios@0.27.2 instance into the same patched resolution — without the resolution, Yarn Classic would have continued installing a vulnerable nested copy under analytics-node. Both the ^0.27.2 and ^1.18.0 lockfile selectors now resolve to 1.20.0.

undici

undici was pulled in transitively by @actions/http-client@4.0.0 (itself a dependency of the direct @actions/core@3.0.1) via a ^6.23.0 range, resolving to the vulnerable 6.24.1. The existing ^6.23.0 range already admits the patched 6.28.1, so no manifest change was required for this package — a lockfile refresh via yarn upgrade 'undici@^6.23.0' was sufficient to advance the resolved version to 6.28.1.

Version changes

Package	From	To	Why updated
axios	0.27.2	1.20.0	Direct CVE fix; added as direct dep + resolutions override to replace vulnerable transitive from analytics-node@6.2.0
undici	6.24.1	6.28.1	Lockfile refresh only; existing ^6.23.0 range from @actions/http-client@4.0.0 already admitted the patched version

Testing

Docs

• Yes! ✋ I have updated the documentation.

Security Impact — CVE vulnerabilities fixed by this PR

✅ 16 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2025-62718	HIGH	[axios] Improper hostname normalization in NO_PROXY rule checking allows requests to loopback addresses (localhost., [::1]) to bypass proxy protections, enabling proxy bypass and potential SSRF attacks against internal services. This vulnerability permits attackers to reach sensitive services despite configured NO_PROXY protections.
AIKIDO-2026-10741	HIGH	[axios] HTTP client vulnerability allowing prototype pollution through loose object merging, sensitive data exposure via error serialization, and improper proxy/socket handling that could lead to information disclosure or unauthorized access.
CVE-2026-40175	HIGH	[axios] A prototype pollution vulnerability in a third-party dependency can be exploited to inject unsanitized header values into outbound HTTP requests. This could allow attackers to manipulate request headers for potential information disclosure or request forgery attacks.
AIKIDO-2026-291630	HIGH	[axios] HTTP adapter fails to strip custom credential headers (like X-API-Key) during cross-origin redirects, potentially leaking API keys and authentication tokens to unintended hosts. This information disclosure vulnerability affects shared environments where secret headers are set by default.
AIKIDO-2026-10509	HIGH	[axios] Prototype pollution vulnerability allows attackers to inject malicious headers into requests through unsafe FormData detection and header merging, potentially enabling authorization bypass or request manipulation.
CVE-2026-44495	MEDIUM	[axios] Contains prototype-pollution gadgets in request config processing that can be exploited if Object.prototype is already polluted by another vulnerability, potentially allowing arbitrary code execution or request manipulation. Requires a separate prototype-pollution vulnerability or attacker control over Object.prototype to be exploitable.
CVE-2023-45857	MEDIUM	[axios] An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
CVE-2026-25639	MEDIUM	[axios] The mergeConfig function crashes with a TypeError when processing configuration objects containing proto as an own property, allowing attackers to trigger denial of service. An attacker can exploit this by providing a malicious configuration object created via JSON.parse().
AIKIDO-2025-10185	MEDIUM	[axios] A server-side request forgery (SSRF) vulnerability exists due to allowAbsoluteUrls not being set to false by default in buildFullPath(), allowing attackers to bypass URL restrictions and process unintended URLs.
AIKIDO-2026-38469	MEDIUM	[axios] Accepts malformed HTTP/HTTPS URLs without // (e.g., https:internal.example), allowing attackers to bypass URL allowlists or WAF checks and reach unintended hosts. The vulnerability enables URL validation bypass through silent normalization of invalid URLs.
CVE-2025-27152	MEDIUM	[axios] Axios sends requests to absolute URLs even when baseURL is configured, bypassing intended routing and potentially causing Server-Side Request Forgery (SSRF) and credential leakage in both server and client environments.
AIKIDO-2023-10001	LOW	[axios] Prototype pollution vulnerability in the formDataToJSON function allows attackers to modify object prototypes. Additionally, a ReDoS vulnerability in combineURLs can cause denial of service through malicious input.
AIKIDO-2026-145478	HIGH	[undici] WebSocket client fails to limit the number of message fragments, allowing a malicious server to send unlimited continuation frames that bypass payload size checks and cause unbounded memory growth, leading to denial of service.
AIKIDO-2026-775839	HIGH	[undici] WebSocket client crashes with an uncaught TypeError when receiving an unrequested Sec-WebSocket-Protocol header in a 101 response, causing process termination. The vulnerability allows remote servers to trigger a Denial of Service by sending unexpected subprotocol headers during the handshake.
AIKIDO-2026-48713	MEDIUM	[undici] The Set-Cookie parser incorrectly percent-decodes cookie values, allowing encoded sequences like %0D%0A to become literal bytes. This enables HTTP response header injection attacks (session fixation, open redirect, cache poisoning) when parsed values are forwarded to response headers.
AIKIDO-2026-253444	LOW	[undici] The retry interceptor can append resumed response bytes to a body already delivered, causing the actual body to exceed the Content-Length header. This allows excess bytes to be interpreted as a separate HTTP response by downstream peers, enabling HTTP response smuggling attacks.

Breaking Changes & Upgrade Impact

⚠️ Incomplete breaking changes analysis (1/2 analyzed)

⚠️ Breaking changes analysis not available for: axios

✅ No breaking changes from either axios or undici upgrades affect this codebase.

Axios (0.27.2 => 1.18.0):

• The codebase uses analytics-node library which internally uses axios

• The axios instance is created via axios.create(options.axiosConfig) without any baseURL configuration

• All requests use absolute URLs via this.axiosInstance.post(\${this.host}${this.path}`, data, req)wherehostdefaults to'https://api.segment.io'` and path to '/v1/batch'

• Since no baseURL is configured and requests use absolute URLs, the axios 1.8.0 URL combining behavior change does not apply

Undici (6.24.1 => 6.28.1):

• Undici is a dependency of @actions/http-client (used by @actions/core)

• The codebase does not directly use any undici-specific features:

  • No parseSetCookie or setCookie calls

  • No WebSocket usage (only internal undici code references found in dist bundle)

  • No direct cookie manipulation

  • No retry interceptor usage with partial responses

  • No blob-like request bodies

• All undici usage is abstracted through the @actions/core library for basic input/output operations

All breaking changes by upgrading undici from version 6.24.1 to 6.28.1 (CHANGELOG)

Version	Description
6.27.0	WebSocket fragment count limit enforced - applications using WebSocket against untrusted endpoints will now reject messages with excessive fragment counts that previously would have been accepted (though this caused DoS)
6.27.0	Set-Cookie percent-decoding removed - parseSetCookie no longer applies percent-decoding to cookie values, changing behavior for cookies containing encoded sequences like %0D%0A and %00
6.27.0	SameSite attribute parsing strictness - cookie parser now requires exact matches for SameSite values (Strict, Lax, None) rather than accepting them as substrings, rejecting previously accepted values like SameSite=NoneOfYourBusiness
6.27.0	Idle socket validation changes - keep-alive socket reuse behavior modified to prevent response queue poisoning, potentially affecting applications relying on previous socket reuse timing
6.28.0	Content-Length validation on partial responses - retry interceptor now rejects partial responses whose Content-Length is inconsistent with Content-Range, where previously inconsistent responses may have been accepted
6.28.0	Cookie domain, path, and unparsed attribute validation - setCookie() now applies stricter validation that may reject previously accepted unsanitized domain and unparsed values
6.28.0	Blob-like request body type property validation - malicious or invalid type properties on duck-typed blob-like HTTP/1.1 request bodies are now coerced and validated, potentially rejecting previously accepted values

For contributions to the Typeform/.github repo

Note: Please do not use this repository for new internal shared workflows and actions. Use https://github.com/Typeform/.github-private instead!

Please check that your contribution applies to one of these cases below. If this is not the case, please contribute to https://github.com/Typeform/.github-private instead.

• This PR only changes an existing workflow.
• This PR adds a new workflow that is needed in a public Typeform repository.

[pr-auditor]

✅ Security Analysis Results

No security issues found. 2 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5 · Docs · #security-engineering-team