fix: Fix 36 security issues in fast-uri, protobufjs, ws and 17 more

[aikido-autofix]

Upgrade dependencies to fix critical SSRF/host-bypass vulnerabilities in fast-uri, memory exhaustion in adm-zip, and security issues in protobufjs, ws, mysql2, and others.

⚠️ Incomplete breaking changes analysis (16/20 analyzed)

⚠️ Breaking changes analysis not available for: @browserbasehq/stagehand, pg-connection-string, vue-i18n, tar-fs

✅ After thoroughly searching the codebase, no breaking changes from the package upgrades affect this codebase:

adm-zip (0.5.10 => 0.6.0): The package is used as a dependency (in epub2 package), but extractEntryTo is not called anywhere in the codebase. The Node.js 14 requirement is satisfied (project requires Node.js >=22.16).

mysql2 (3.17.0 => 3.23.1): While mysql2 is used extensively in the codebase and supportBigNumbers is enabled in packages/nodes-base/nodes/MySql/v2/transport/index.ts:6, the breaking change about unsafe integers in JSON columns only affects cases where JSON columns contain unsafe integers. The codebase does not appear to rely on the previous behavior of returning unsafe integers as numbers from JSON columns. The mysql_clear_password plugin is not used.

sharp (0.33.5 => 0.35.0): The package is used, but none of the deprecated features (failOnError, paletteBitDepth, format.jp2k, deprecated sharpen properties) are used in the codebase. The Node.js 20 requirement is satisfied (project requires Node.js >=22.16).

body-parser (2.2.1 => 2.3.0): The package is used in packages/cli/src/middlewares/body-parser.ts, where the limit parameter is set to a valid string value (${String(payloadSizeMax)}mb), not an invalid value that would trigger the new throwing behavior.

@langchain/langgraph-checkpoint (1.0.0 => 1.0.3): The package is used with MemorySaver in the AI workflow builder. The thread_id values are generated using SessionManagerService.generateThreadId(workflowId, userId) which creates strings like workflow-{workflowId}-user-{userId}. These are valid string values and do not use reserved keys like __proto__, constructor, or prototype.

linkify-it (5.0.1 => 5.0.2): This is a security fix (DoS prevention) with no breaking changes to the API.

All breaking changes by upgrading mysql2 from version 3.17.0 to 3.23.1 (CHANGELOG)

Version	Description
3.22.0	mysql_clear_password plugin is now disabled by default
3.23.0	Unsafe integers inside JSON columns are now returned as exact strings when supportBigNumbers is enabled (previously they would have been returned as numbers)

All breaking changes by upgrading body-parser from version 2.2.1 to 2.3.0 (CHANGELOG)

Version	Description
2.3.0	Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

All breaking changes by upgrading @langchain/langgraph-checkpoint from version 1.0.0 to 1.0.3 (CHANGELOG)

Version	Description
1.0.3	MemorySaver now rejects non-string values, empty strings (unless explicitly opted-in for checkpoint_ns), and the reserved keys "__proto__", "constructor", or "prototype" for thread_id, checkpoint_ns, checkpoint_id, and task_id fields, which could cause previously working code using these values to fail.

All breaking changes by upgrading adm-zip from version 0.5.10 to 0.6.0 (CHANGELOG)

Version	Description
0.6.0	extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files)
0.6.0	Minimum Node.js is now 14 (previously allowed >=12)
0.6.0	CVE-2026-39244 fix — allocation is now bounded by the data actually present, which may reject archives declaring huge uncompressed sizes that previously would have been processed (before OOM)

All breaking changes by upgrading linkify-it from version 5.0.1 to 5.0.2 (CHANGELOG)

Version	Description
5.0.2	Fixed DoS in mailto: links (restrict user name to 64 chars)
5.0.2	Restricted user/pass part length in links

✅ 36 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-878106	HIGH	[fast-uri] URI authority parsing fails to treat backslashes as delimiters, allowing different host interpretations compared to Node's WHATWG URL parser, enabling bypass of host allowlists, SSRF filters, and redirect validation checks. The vulnerability permits attackers to circumvent security controls through crafted URIs containing backslashes.
AIKIDO-2026-507986	HIGH	[fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization.
CVE-2026-13676	HIGH	[fast-uri] A vulnerability in IDN hostname canonicalization allows Unicode hostnames to bypass host-based security policies (denylists, loopback filtering, redirects) when fast-uri's output differs from standard URL parsers. This enables attackers to circumvent security controls that rely on host validation.
CVE-2026-16221	HIGH	[fast-uri] A parsing discrepancy in fast-uri allows backslash characters to bypass host-based security policies like allowlists and SSRF filters, enabling attackers to redirect requests to unintended destinations including internal hosts and cloud metadata endpoints.
AIKIDO-2026-123346	HIGH	[adm-zip] A path traversal vulnerability in ZIP extraction allows attackers to allocate arbitrarily large buffers by crafting archives with inflated declared uncompressed sizes, causing denial of service through memory exhaustion and process crashes.
CVE-2026-39244	LOW	[adm-zip] A crafted ZIP file with manipulated uncompressed size headers causes excessive memory allocation without validation, leading to denial of service and process crashes. An attacker can create a ~120-byte file declaring ~4GB uncompressed size, achieving a 33 million to 1 amplification ratio.
AIKIDO-2026-732519	HIGH	[tar] A crafted tar archive with a negative base-256 encoded size can cause the library to loop infinitely on the same header during archive scanning, resulting in a denial of service that pins the worker process.
AIKIDO-2026-986821	HIGH	[tar] A decompression bomb vulnerability allows attackers to exhaust disk storage by crafting TAR archives with highly compressible data claiming massive file sizes, causing denial of service through uncontrolled resource consumption during extraction.
CVE-2026-59873	HIGH	[tar] A gzip bomb vulnerability allows attackers to craft small malicious tar archives that exhaust disk space and CPU resources during extraction due to missing decompression limits. This enables denial of service attacks through uncontrolled decompression of highly compressed data.
CVE-2026-59874	HIGH	[tar] A vulnerability allows attackers to craft malicious tar archives with negative base-256 encoded entry sizes that cause the archive scanner to enter an infinite loop, resulting in a denial of service. The flaw exploits improper validation of checksum-valid tar headers with crafted size values.
CVE-2026-59871	HIGH	[tar] A vulnerability in PAX path handling coerces all-digit values to numbers, causing uncaught TypeErrors in downstream path processing. This leads to denial of service through application crashes when processing malicious tar archives.
AIKIDO-2026-568044	MEDIUM	[tar] A parsing vulnerability allows crafted PAX extended headers with embedded NUL bytes in paths to bypass validation and cause uncaught exceptions during archive extraction, enabling denial of service and validator bypass attacks.
CVE-2026-59875	MEDIUM	[tar] A crafted tar archive with NUL bytes in PAX path and linkpath records can cause an uncaught exception in fs.lstat or fs.open, leading to denial of service by terminating the process.
AIKIDO-2026-401672	MEDIUM	[tar] A PAX header parser vulnerability coerces path values to numbers, causing an uncaught TypeError when downstream code calls .split('/') on the numeric value, crashing the Node.js process during archive extraction.
AIKIDO-2026-48452	MEDIUM	[tar] A recursive function in the filesFilter helper lacks depth limits, allowing a crafted archive with extremely long paths to cause stack overflow and crash the process. This results in a denial of service for applications that stream or asynchronously extract archives.
GHSA-r292-9mhp-454m	MEDIUM	[tar] A stack-exhaustion denial-of-service vulnerability in the mapHas helper causes uncaught RangeError when listing or extracting selected members from a crafted tar archive with an extremely long path (tens of thousands of segments). The recursive path traversal lacks depth limits and executes outside error handling, crashing Node processes on async/streaming consumers.
CVE-2026-59877	HIGH	[protobufjs] A parsing vulnerability allows crafted .proto schemas with incomplete option declarations to cause infinite loops in parse, Root.load, or Root.loadSync functions, resulting in denial of service.
AIKIDO-2026-138234	HIGH	[ws] A remote attacker can send fragmented WebSocket frames with high default limits on fragment retention, causing excessive heap memory consumption and denial of service without completing the message or exceeding payload limits.
AIKIDO-2026-765062	HIGH	[mysql2] A rogue or man-in-the-middle MySQL server can force the driver to transmit passwords in cleartext by switching to the mysql_clear_password authentication plugin on unencrypted connections, enabling credential capture. The vulnerability allows authentication bypass and information disclosure through plaintext password transmission.
AIKIDO-2026-448685	MEDIUM	[mysql2] A vulnerability in compressed packet handling allows attackers to expand small payloads into large buffers without size validation, causing CPU or memory exhaustion through decompression bombs. The issue stems from missing output size limits when inflating zlib-compressed frames.
CVE-2026-14257	HIGH	[brace-expansion] Denial of service via memory exhaustion when expand() processes chained brace groups, allowing attackers to crash applications with small inputs by generating progressively longer result strings that exceed memory limits.
AIKIDO-2026-237551	MEDIUM	[brace-expansion] A recursive expansion function computes unnecessary segments before early returns, causing exponential time complexity when processing consecutive non-expanding brace groups, enabling denial-of-service attacks through short malicious inputs that can stall processes or workers.
CVE-2026-13149	MEDIUM	[brace-expansion] A denial of service vulnerability exists in the expand() function due to exponential-time complexity when processing consecutive non-expanding brace groups, allowing attackers to cause significant CPU consumption and event-loop blocking.
GHSA-f88m-g3jw-g9cj	HIGH	[sharp] Multiple high-severity vulnerabilities in upstream libvips dependency allow remote code execution when processing untrusted image input (GIF, TIFF, VIPS formats).
AIKIDO-2026-476466	MEDIUM	[fast-xml-builder] XML serialization fails to escape quotes in stop-node attributes and double-hyphens in comments, allowing untrusted input to inject arbitrary XML attributes/elements leading to XSS when rendered as HTML.
CVE-2026-12590	MEDIUM	[body-parser] Invalid limit option values cause the request body size check to be silently skipped, allowing arbitrarily large payloads and leading to denial of service through excessive memory and CPU usage. The vulnerability affects configurations with unparseable strings or NaN values that bypass size enforcement.
AIKIDO-2026-135497	MEDIUM	[@vue/server-renderer] A server-side rendering vulnerability allows attackers to inject arbitrary HTML or script by crafting overlapping comment markers that bypass single-pass escaping, leaving residual delimiters that break out of SSR comments. The fix applies repeated stripping until output is stable to prevent delimiter reconstruction.
AIKIDO-2026-624585	MEDIUM	[@vue/shared] A regex-based HTML comment sanitizer fails to prevent reconstruction of comment delimiters through overlapping sequences, allowing attackers to inject HTML and execute arbitrary JavaScript when rendering untrusted data in comments during server-side rendering.
AIKIDO-2026-712572	MEDIUM	[nanoid] Improper input validation in the random-byte pool allocation allows attackers to trigger excessive memory allocation through oversized ID length requests, causing denial-of-service or process crashes. Applications using untrusted input for ID length are vulnerable.
AIKIDO-2026-836981	MEDIUM	[pg] Prototype pollution vulnerability in query result handling allows a rogue PostgreSQL server to inject malicious column names that pollute Object.prototype, causing denial of service, unexpected behavior, or gadget chain exploitation.
AIKIDO-2026-554446	MEDIUM	[pg-connection-string] Prototype pollution vulnerability in PostgreSQL connection string parsing allows attackers to modify Object.prototype via malicious keys, enabling denial of service or potential remote code execution.
AIKIDO-2026-10838	MEDIUM	[@intlify/shared] A sanitization bypass vulnerability allows script execution through entity-encoded javascript: URLs and obfuscated schemes in HTML attributes and CSS when using v-html with escapeParameterHtml enabled, enabling XSS attacks.
AIKIDO-2026-414442	MEDIUM	[tar-fs] Path traversal and symlink vulnerabilities in tar extraction allow attackers to escape the intended extraction directory and write arbitrary files, potentially enabling remote code execution or unauthorized file modification.
AIKIDO-2026-555920	MEDIUM	[@langchain/langgraph-checkpoint] Prototype pollution vulnerability in MemorySaver allows attackers to inject malicious properties into Object.prototype by supplying reserved keys like __proto__ or constructor as identifiers, potentially enabling remote code execution or denial of service across the application.
CVE-2026-59869	LOW	[js-yaml] A vulnerability allows attackers to cause a denial of service through quadratic CPU consumption by crafting YAML documents with chained mappings using merge keys, where linear document size results in exponential processing time. This enables resource exhaustion attacks against systems parsing untrusted YAML input.
CVE-2026-59887	LOW	[linkify-it] A regular expression denial of service (ReDoS) vulnerability in the mailto schema validator causes O(n^2) CPU consumption when processing crafted input, enabling denial of service attacks through resource exhaustion.

🔗 Related Tasks

• https://linear.app/n8n/issue/SEC-928/small-upgrade-for-brace-expansion-n8n
• https://linear.app/n8n/issue/SEC-909/small-upgrade-for-tar-n8n
• https://linear.app/n8n/issue/SEC-870/small-upgrade-for-fast-uri-n8n
• https://linear.app/n8n/issue/SEC-900/minor-upgrade-for-adm-zip-n8n
• https://linear.app/n8n/issue/SEC-920/small-upgrade-for-ws-n8n

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #35384