fix(security): fix 13 security issues in axios, undici

[aikido-autofix]

Overview

Jira ticket: https://typeform.atlassian.net/browse/<TICKET_ID>

Upgrade axios and undici to fix SSRF/proxy bypass, prototype pollution header injection, credential leakage on cross-origin redirects, and unsafe error serialization vulnerabilities.

Changes

🤖 Remediation details

Fix security vulnerabilities in axios and undici transitive dependencies

Short summary

This PR remediates multiple high- and medium-severity vulnerabilities in two transitive dependencies — axios and undici — within shared-actions/send-deployment-event. Changes touch shared-actions/send-deployment-event/package.json (new direct dependency entry, new resolutions field) and shared-actions/send-deployment-event/yarn.lock (lockfile entries refreshed to patched resolved versions).

axios

axios was pulled in transitively by the direct dependency analytics-node@6.2.0, which declares axios@^0.27.2, resolving to the vulnerable 0.27.2. Because analytics-node@6.2.0 is the latest published release and still pins ^0.27.2 (a range that cannot resolve to the patched 1.x line across the semver-major boundary), no parent bump was possible. To force both the direct and transitive selectors to a safe version, axios@^1.18.0 was added as an explicit direct dependency and a resolutions entry "axios": "^1.18.0" was added to the same package.json, causing Yarn to resolve both the ^0.27.2 and ^1.18.0 selectors to a single patched lockfile entry (1.20.0).

undici

undici was pulled in transitively by @actions/http-client@4.0.0 (itself a dependency of @actions/core@3.0.1), which declares undici@^6.23.0. That range already permits 6.26.0+, so no manifest change was required for undici itself — a lockfile refresh via yarn upgrade 'undici@^6.23.0' was sufficient to advance the resolved version from the vulnerable 6.24.1 to the patched 6.28.1.

Version changes

Package	From	To	Why updated
axios	0.27.2	1.20.0	Direct CVE fix; resolutions required because sole parent analytics-node@6.2.0 pins ^0.27.2 with no newer release
undici	6.24.1	6.28.1	Transitive CVE fix; lockfile refresh only — parent range ^6.23.0 already admitted patched version

Testing

Docs

• Yes! ✋ I have updated the documentation.

Security Impact — CVE vulnerabilities fixed by this PR

✅ 13 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2025-62718	HIGH	[axios] Improper hostname normalization in NO_PROXY rule checking allows requests to loopback addresses (localhost., [::1]) to bypass proxy protections, enabling proxy bypass and potential SSRF attacks against internal services. This vulnerability permits attackers to reach sensitive services despite configured NO_PROXY protections.
AIKIDO-2026-10741	HIGH	[axios] HTTP client vulnerability allowing prototype pollution through loose object merging, sensitive data exposure via error serialization, and improper proxy/socket handling that could lead to information disclosure or unauthorized access.
CVE-2026-40175	HIGH	[axios] A prototype pollution vulnerability in a third-party dependency can be exploited to inject unsanitized header values into outbound HTTP requests. This could allow attackers to manipulate request headers for potential information disclosure or request forgery attacks.
AIKIDO-2026-291630	HIGH	[axios] HTTP adapter fails to strip custom credential headers (like X-API-Key) during cross-origin redirects, potentially leaking API keys and authentication tokens to unintended hosts. This information disclosure vulnerability affects shared environments where secret headers are set by default.
AIKIDO-2026-10509	HIGH	[axios] Prototype pollution vulnerability allows attackers to inject malicious headers into requests through unsafe FormData detection and header merging, potentially enabling authorization bypass or request manipulation.
CVE-2023-45857	MEDIUM	[axios] An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
CVE-2026-25639	MEDIUM	[axios] The mergeConfig function crashes with a TypeError when processing configuration objects containing proto as an own property, allowing attackers to trigger denial of service. An attacker can exploit this by providing a malicious configuration object created via JSON.parse().
AIKIDO-2025-10185	MEDIUM	[axios] A server-side request forgery (SSRF) vulnerability exists due to allowAbsoluteUrls not being set to false by default in buildFullPath(), allowing attackers to bypass URL restrictions and process unintended URLs.
AIKIDO-2026-38469	MEDIUM	[axios] Accepts malformed HTTP/HTTPS URLs without // (e.g., https:internal.example), allowing attackers to bypass URL allowlists or WAF checks and reach unintended hosts. The vulnerability enables URL validation bypass through silent normalization of invalid URLs.
CVE-2025-27152	MEDIUM	[axios] Axios sends requests to absolute URLs even when baseURL is configured, bypassing intended routing and potentially causing Server-Side Request Forgery (SSRF) and credential leakage in both server and client environments.
AIKIDO-2023-10001	LOW	[axios] Prototype pollution vulnerability in the formDataToJSON function allows attackers to modify object prototypes. Additionally, a ReDoS vulnerability in combineURLs can cause denial of service through malicious input.
AIKIDO-2026-145478	HIGH	[undici] WebSocket client fails to limit the number of message fragments, allowing a malicious server to send unlimited continuation frames that bypass payload size checks and cause unbounded memory growth, leading to denial of service.
AIKIDO-2026-48713	MEDIUM	[undici] The Set-Cookie parser incorrectly percent-decodes cookie values, allowing encoded sequences like %0D%0A to become literal bytes. This enables HTTP response header injection attacks (session fixation, open redirect, cache poisoning) when parsed values are forwarded to response headers.

Breaking Changes & Upgrade Impact

⚠️ Incomplete breaking changes analysis (1/2 analyzed)

⚠️ Breaking changes analysis not available for: axios

✅ No breaking changes from the axios upgrade affect this codebase.

The codebase does not directly use axios - it only uses the analytics-node package which internally depends on axios. The analytics-node package uses axios in a simple way: it creates an axios instance without a baseURL and makes POST requests with complete absolute URLs (https://api.segment.io/v1/batch). This usage pattern is not affected by the URL combination breaking change in axios 1.8.0.

Additionally, the source code does not use any deprecated axios features like CancelToken, axios.Cancel, axios.all, or axios.spread that were changed in axios 1.0.0.

All breaking changes by upgrading undici from version 6.24.1 to 6.28.1 (CHANGELOG)

Version	Description
6.27.0	WebSocket fragment count limit enforced - applications using WebSocket against untrusted endpoints will now reject messages with excessive fragment counts that previously would have been accepted (though this caused DoS)
6.27.0	Set-Cookie percent-decoding removed - parseSetCookie no longer applies percent-decoding to cookie values, changing behavior for cookies containing encoded sequences like %0D%0A and %00
6.27.0	SameSite attribute parsing strictness - cookie parser now requires exact matches for SameSite values (Strict, Lax, None) rather than accepting them as substrings, rejecting previously accepted values like SameSite=NoneOfYourBusiness
6.27.0	Idle socket validation changes - keep-alive socket reuse behavior modified to prevent response queue poisoning, potentially affecting applications relying on previous socket reuse timing
6.28.0	Content-Length validation on partial responses - retry interceptor now rejects partial responses whose Content-Length is inconsistent with Content-Range, where previously inconsistent responses may have been accepted
6.28.0	Cookie domain, path, and unparsed attribute validation - setCookie() now applies stricter validation that may reject previously accepted unsanitized domain and unparsed values
6.28.0	Blob-like request body type property validation - malicious or invalid type properties on duck-typed blob-like HTTP/1.1 request bodies are now coerced and validated, potentially rejecting previously accepted values

For contributions to the Typeform/.github repo

Note: Please do not use this repository for new internal shared workflows and actions. Use https://github.com/Typeform/.github-private instead!

Please check that your contribution applies to one of these cases below. If this is not the case, please contribute to https://github.com/Typeform/.github-private instead.

• This PR only changes an existing workflow.
• This PR adds a new workflow that is needed in a public Typeform repository.

[pr-auditor]

✅ Security Analysis Results

No security issues found. 2 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5 · Docs · #security-engineering-team