fix(security): [Aikido] [SEC-611] Fix 19 security issues in x/net, gofiber/fiber/v2, x/sys

[aikido-autofix]

Upgrade dependencies to fix critical privilege escalation via Punycode validation bypass, HTTP/2 infinite loop DoS, DNS parsing panic, and Fiber route parameter DoS vulnerabilities.

✅ 19 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-11039	🚨 CRITICAL	[golang.org/x/net] Punycode validation bypass in idna functions allows ASCII-only labels to be incorrectly accepted, enabling privilege escalation when hostname validation is bypassed through encoded domain names. An attacker could exploit inconsistent validation between encoded and decoded hostnames to circumvent access controls.
CVE-2026-39821	🚨 CRITICAL	[golang.org/x/net] Punycode validation bypass in idna functions allows ASCII-only labels to be incorrectly accepted, enabling privilege escalation when hostname validation is bypassed through encoded domain names. An attacker could exploit inconsistent validation between encoded and decoded hostnames to circumvent access controls.
CVE-2026-33814	HIGH	[golang.org/x/net] When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
CVE-2026-46600	HIGH	[golang.org/x/net] Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
AIKIDO-2026-11035	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
AIKIDO-2026-11036	MEDIUM	[golang.org/x/net] The HTML parser mishandled character references in DOCTYPE nodes, causing them to be incorrectly rendered. This can lead to XSS when rendering parsed HTML.
AIKIDO-2026-11038	MEDIUM	[golang.org/x/net] The HTML parser mishandled certain HTML elements in foreign content, causing them to be incorrectly rendered. This can lead to XSS when rendering parsed HTML.
AIKIDO-2026-11040	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-42506	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-25681	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-27136	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-42502	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
AIKIDO-2026-11037	LOW	[golang.org/x/net] Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
CVE-2026-25680	LOW	[golang.org/x/net] Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
CVE-2026-25882	HIGH	[github.com/gofiber/fiber/v2] A denial of service vulnerability allows remote attackers to crash the application by sending requests to routes with excessive parameters, caused by missing validation during route registration and unbounded array writes during request matching.
CVE-2026-42554	MEDIUM	[github.com/gofiber/fiber/v2] Cross-Site Scripting (XSS) vulnerability in AutoFormat() allows remote attackers to inject arbitrary HTML/JavaScript by manipulating the Accept header to force HTML output of attacker-controlled data. The vulnerability occurs when developers use AutoFormat() without explicitly opting into HTML emission, allowing attackers to exploit content negotiation.
CVE-2026-45045	MEDIUM	[github.com/gofiber/fiber/v2] The BalancerForward proxy helper incorrectly uses Header.Add() instead of Header.Set() for X-Real-IP injection, allowing attackers to spoof their IP address and bypass upstream logging, rate limiting, and access control mechanisms.
AIKIDO-2026-11041	LOW	[golang.org/x/sys] NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
CVE-2026-39824	LOW	[golang.org/x/sys] NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

🔗 Related Tasks

• https://linear.app/honestbank/issue/SEC-611/minor-upgrade-for-golangorgxnet