[Security] fast-uri vulnerable to host confusion attacks

[github-actions]

Security Vulnerability Report

Summary

• Package: fast-uri (transitive dependency via ajv)
• Affected Version: 3.1.2 (current in package-lock.json)
• Severity: HIGH
• CVE/Advisory: GHSA-4c8g-83qw-93j6, GHSA-v2hh-gcrm-f6hx
• CVSS Score: 7.5 each

Vulnerability Details

GHSA-4c8g-83qw-93j6: fast-uri vulnerable to host confusion via failed IDN canonicalization — CWE-436, CWE-551

GHSA-v2hh-gcrm-f6hx: fast-uri vulnerable to host confusion via literal backslash authority delimiter — CWE-436

Both vulnerabilities allow an attacker to craft URIs that appear to point to one host but are resolved to another, enabling bypasses of host-based access controls.

Impact on gh-aw-firewall

fast-uri is used by ajv (JSON schema validation). The domain allowlist validation in AWF relies on correct URI parsing — host confusion vulnerabilities could theoretically allow crafted URIs to bypass domain whitelisting checks.

Remediation Steps

1. Recommended Fix: Update fast-uri to >=3.1.4 via npm audit fix
2. Command: npm audit fix
3. Status: A fix PR has been opened alongside this issue.

Testing Required

• Run full test suite after update
• Verify firewall domain allowlist functionality
• Test Docker container builds

References

• GHSA-4c8g-83qw-93j6
• GHSA-v2hh-gcrm-f6hx

Detection Details

• Detected by: Dependency Security Monitor Workflow
• Detection Time: 2026-07-22T03:47:25Z
• Source: npm audit

Generated by Dependency Security Monitor · 37.8 AIC · ⊞ 8.8K · ◷

• expires on Aug 21, 2026, 3:50 AM UTC