fix(security): [Aikido] [SEC-400, SEC-292, SEC-464, SEC-478, SEC-527, SEC-542, SEC-521, SEC-604] Fix 1 critical issue in tough-cookie and 52 other issues

[aikido-autofix]

Upgrade dependencies to fix critical RCE vulnerabilities in Handlebars and Lodash template injection, prototype pollution in tough-cookie, and insufficient randomness in form-data. This update includes breaking changes that require manual migration.

⚠️ Incomplete breaking changes analysis (16/23 analyzed)

⚠️ Breaking changes analysis not available for: pino, minimatch, @octokit/endpoint, ajv, @octokit/plugin-paginate-rest, @octokit/request, @octokit/request-error

⚠️ ## Breaking Changes Affecting This Codebase

js-yaml (3.14.0 => 4.3.0)

Where your code is affected:

• lib/settings/settings.js:113 - uses yaml.safeLoad(settings)

• lib/configuration/configuration.js:161 - uses yaml.safeLoad(content)

• lib/configuration/configuration.js:181 - uses yaml.safeLoad(orgConfig)

• __fixtures__/unit/helper.js:27 - uses yaml.safeLoad(configString)

• Multiple test files use yaml.safeLoad() throughout

Impact:

The yaml.safeLoad() method has been deprecated in js-yaml 4.x and replaced with yaml.load(). All calls to yaml.safeLoad() will fail as the method no longer exists.

Remediation:

Replace all instances of yaml.safeLoad() with yaml.load() throughout the codebase (settings.js, configuration.js, helper.js, and test files).

handlebars (4.7.7 => 4.7.9)

Where your code is affected:

• lib/actions/handlebars/populateTemplate.js:5-50 - registers multiple custom helpers and uses handlebars.compile()

• lib/actions/merge.js:3,15,19 - uses handlebars.compile() for commit title and message templates

Impact:

Security fixes in 4.7.9 may restrict previously allowed behavior in template compilation. While the basic compile() usage should work, the security restrictions could affect template processing if any templates use patterns that are now blocked.

Remediation:

Test all handlebars template compilation thoroughly, especially custom helpers (breaklines, toUpperCase, formatDate, displaySettings, ifEquals, statusIcon) and template usage in merge actions to ensure security restrictions don't break functionality.

pino (8.19.0 => 10.1.1)

Where your code is affected:

• package.json:34 - specifies Node.js engine as ^20

• Pino is used indirectly through probot dependency

Impact:

Pino 10.x drops support for Node.js 18. The codebase currently requires Node.js ^20, so this is compatible. However, if the runtime environment uses Node.js 18, the application will fail to start.

Remediation:

Ensure deployment environments use Node.js 20 or higher. Verify that the Node.js version constraint in package.json (^20) is enforced in all deployment pipelines.

lodash (4.17.21 => 4.18.1)

Where your code is affected:

• lib/actions/handlebars/populateTemplate.js:56 - uses _.merge({}, payload, validationResult)

Impact:

The _.merge() function now blocks constructor and prototype as path keys. If payload or validationResult objects contain these keys, the merge operation will behave differently (leaving target untouched instead of merging).

Remediation:

Review all data sources passed to _.merge() in populateTemplate.js to ensure they don't rely on merging constructor or prototype properties. Add validation to reject or sanitize such properties if they appear in user-controlled data.

All breaking changes by upgrading tough-cookie from version 2.5.0 to 4.1.3 (CHANGELOG)

Version	Description
4.0.0	Re-order parameters for findCookies() - callback function must be last parameter
4.0.0	Use Classes instead of function prototypes to define classes - may break code using .call() for inheritance with function prototypes

All breaking changes by upgrading handlebars from version 4.7.7 to 4.7.9 (CHANGELOG)

Version	Description
4.7.9	Security fixes that may restrict previously allowed behavior (multiple security advisories addressed)

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

All breaking changes by upgrading body-parser from version 1.20.1 to 1.20.6 (CHANGELOG)

Version	Description
1.20.3	The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
1.20.6	Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

All breaking changes by upgrading jws from version 3.2.2 to 3.2.3 (CHANGELOG)

Version	Description
3.2.3	createSign and createVerify now require that a non-empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms

All breaking changes by upgrading uuid from version 3.4.0 to 11.1.1 (CHANGELOG)

Version	Description
7.0.0	The default export, which used to be the v4() method, has been removed.
7.0.0	Deep imports of the different uuid version functions are deprecated and emit a deprecation warning.
7.0.0	Builtin support for insecure random number generators in the browser has been removed.
7.0.0	Support for generating v3 and v5 UUIDs in Node.js<4.x has been removed.
8.0.0	For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.
8.0.0	Deep requiring specific algorithms like require('uuid/v4') is no longer supported.
8.2.0	Deprecated v4 string parameter has been removed.
9.0.0	Node.js 10.x support has been dropped.
9.0.0	The minified UMD build has been removed from the package.
9.0.0	IE 11 and Safari 10 support has been dropped, along with msCrypto fallback.
10.0.0	Node.js 12 and 14 support has been dropped (only node 16-20 supported).
11.0.0	v1 internal state and options logic has been refactored.
11.0.0	v7 internal state and options logic has been refactored.

All breaking changes by upgrading brace-expansion from version 1.1.11 to 5.0.8 (CHANGELOG)

Version	Description
3.0.0	Switch to ES Modules and balanced-match 3.0.0

All breaking changes by upgrading express from version 4.18.2 to 4.22.2 (CHANGELOG)

Version	Description
4.20.0	The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
4.20.0	Removes encoding of \, |, and ^ to align better with URL spec
4.22.0	Method functions with no path should error

All breaking changes by upgrading js-yaml from version 4.1.0 to 4.3.0 (CHANGELOG)

Version	Description
4.2.0	Stop resolving numbers with underscores as numeric scalars - previously valid numeric formats with underscores will no longer be parsed as numbers
4.2.0	Reject top-level block scalars without content indentation - YAML documents with top-level block scalars lacking proper indentation that were previously accepted will now be rejected

All breaking changes by upgrading path-to-regexp from version 0.1.7 to 0.1.13 (CHANGELOG)

Version	Description
0.1.10	Add backtrack protection to parameters which will break some edge cases
0.1.11	Add error on bad input values
0.1.12	Improved backtracking protection will break some previously valid paths

All breaking changes by upgrading cookie from version 0.5.0 to 0.7.2 (CHANGELOG)

Version	Description
0.7.0	Narrowed the validation of cookies to match RFC6265, which may reject cookie values that were previously accepted

✅ 53 CVEs resolved by this upgrade, including 4 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2023-26136	🚨 CRITICAL	[tough-cookie] Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
CVE-2026-33937	🚨 CRITICAL	[handlebars] A vulnerability in Handlebars.compile() allows attackers to inject arbitrary JavaScript through crafted AST objects, enabling Remote Code Execution when the NumberLiteral value field is emitted without sanitization.
CVE-2026-33941	HIGH	[handlebars] The Handlebars CLI precompiler fails to sanitize user-controlled template filenames and CLI options, allowing injection of arbitrary JavaScript into generated bundles that executes during loading. This enables remote code execution for attackers who can control precompiler inputs.
CVE-2026-33938	HIGH	[handlebars] A vulnerability allows attackers to execute arbitrary JavaScript by overwriting the @partial-block variable with a malicious Handlebars AST through helpers, enabling remote code execution when the partial block is subsequently invoked.
CVE-2026-33940	HIGH	[handlebars] A crafted object in the template context can bypass conditional guards and trigger compilation of a malicious Handlebars AST, leading to remote code execution on the server when dynamic partial lookups are used.
CVE-2026-33939	HIGH	[handlebars] Unregistered decorator syntax in templates causes unhandled TypeError that crashes the Node.js process, enabling Denial of Service attacks when compiling user-supplied templates without error handling.
GHSA-7rx3-28cr-v5wh	MEDIUM	[handlebars] A prototype method blocklist omits __lookupSetter__ while blocking its symmetric counterparts, allowing prototype pollution when the non-default allowProtoMethodsByDefault: true option is set. This creates an inconsistent security boundary enabling potential code execution or object manipulation through template injection.
CVE-2026-33916	MEDIUM	[handlebars] Prototype pollution vulnerability in resolvePartial() allows attackers to inject malicious strings into Object.prototype that are rendered as unescaped partial templates, enabling reflected or stored XSS attacks.
GHSA-442j-39wm-28r2	LOW	[handlebars] A Time-of-Check Time-of-Use (TOCTOU) vulnerability in the lookup() function allows prototype pollution and property access bypass when the compat option is enabled, potentially leading to information disclosure or code execution. The security check via lookupProperty() is discarded, and an unguarded property access is performed instead.
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.
CVE-2025-7783	🚨 CRITICAL	[form-data] Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
CVE-2026-12143	HIGH	[form-data] A CRLF injection vulnerability in the field and filename arguments allows attackers to inject headers or multipart parts into requests, potentially enabling form field manipulation or bypass attacks when untrusted input is used as field names or filenames.
CVE-2024-45590	HIGH	[body-parser] A denial of service vulnerability exists in URL encoding functionality where specially crafted payloads can flood the server with requests, causing service disruption.
CVE-2026-12590	MEDIUM	[body-parser] Invalid limit option values cause the request body size check to be silently skipped, allowing arbitrarily large payloads and leading to denial of service through excessive memory and CPU usage. The vulnerability affects configurations with unparseable strings or NaN values that bypass size enforcement.
CVE-2025-65945	HIGH	[jws] Improper signature verification in HMAC algorithms allows attackers to bypass signature validation when user-provided data from JWS headers or payloads is used in secret lookup routines. This enables authentication bypass and potential unauthorized access to protected resources.
CVE-2026-2391	HIGH	[qs] Comma-separated value parsing bypasses arrayLimit enforcement when comma: true is enabled, allowing attackers to create arbitrarily large arrays from a single parameter and cause denial-of-service through memory exhaustion.
CVE-2025-15284	LOW	[qs] Improper input validation in array parsing allows the arrayLimit option to be bypassed when using bracket notation, enabling potential HTTP DoS attacks when parameterLimit is set to high values. The vulnerability inconsistently enforces arrayLimit only for indexed notation while ignoring it for bracket notation array syntax.
CVE-2026-41907	HIGH	[uuid] A buffer overflow vulnerability allows v3, v5, and v6 UUID functions to write beyond caller-provided buffer boundaries when given small buffers or large offsets, causing silent data corruption. This can lead to memory corruption and potential code execution or information disclosure.
AIKIDO-2026-10892	MEDIUM	[uuid] UUID functions v3(), v5(), and v6() can write past the end of a caller-provided buffer due to missing offset validation, enabling buffer overflow attacks. The fix adds bounds checks to prevent out-of-range writes.
CVE-2026-14257	HIGH	[brace-expansion] Denial of service via memory exhaustion when expand() processes chained brace groups, allowing attackers to crash applications with small inputs by generating progressively longer result strings that exceed memory limits.
AIKIDO-2026-237551	MEDIUM	[brace-expansion] A recursive expansion function computes unnecessary segments before early returns, causing exponential time complexity when processing consecutive non-expanding brace groups, enabling denial-of-service attacks through short malicious inputs that can stall processes or workers.
CVE-2026-13149	MEDIUM	[brace-expansion] A denial of service vulnerability exists in the expand() function due to exponential-time complexity when processing consecutive non-expanding brace groups, allowing attackers to cause significant CPU consumption and event-loop blocking.
CVE-2026-33750	LOW	[brace-expansion] A brace pattern with zero step value causes an infinite loop, leading to denial of service through process hangs and excessive memory allocation. The vulnerability affects string expansion operations when malicious or malformed patterns are processed.
AIKIDO-2026-10477	LOW	[brace-expansion] A denial-of-service vulnerability allows attackers to craft malicious brace patterns with repeated numeric ranges that cause exponential expansion, consuming excessive CPU and memory until process failure. The fix introduces an optional maximum limit parameter to bound expansion work.
CVE-2025-5889	LOW	[brace-expansion] A regular expression complexity vulnerability in the expand function allows remote attackers to cause denial of service through inefficient regex processing, though exploitation is difficult and requires high attack complexity.
CVE-2024-29041	MEDIUM	[express] A malformed URL encoding vulnerability in the redirect functionality allows attackers to bypass redirect allow lists, enabling open redirects to arbitrary sites. The vulnerability affects res.location() and res.redirect() methods when processing user-provided URLs.
CVE-2024-43796	MEDIUM	[express] .js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
CVE-2025-64718	MEDIUM	[js-yaml] A prototype pollution vulnerability allows attackers to modify object prototypes through malicious YAML documents, potentially leading to arbitrary code execution or application compromise when parsing untrusted input.
AIKIDO-2025-10809	MEDIUM	[js-yaml] A prototype pollution vulnerability allows attackers to inject malicious keys into object prototypes via crafted YAML input, potentially leading to remote code execution, denial of service, or other security breaches.
CVE-2026-59869	LOW	[js-yaml] A vulnerability allows attackers to cause a denial of service through quadratic CPU consumption by crafting YAML documents with chained mappings using merge keys, where linear document size results in exponential processing time. This enables resource exhaustion attacks against systems parsing untrusted YAML input.
CVE-2026-53550	LOW	[js-yaml] A crafted YAML document with repeated aliases in merge-key processing causes quadratic CPU exhaustion, enabling denial of service by blocking the event loop with small payloads. The vulnerability exists in merge handling within the YAML parser.
CVE-2024-43799	MEDIUM	[send] is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
AIKIDO-2024-10253	MEDIUM	[send] Affected versions of the package are vulnerable to Cross-site Scripting (XSS) via the redirect function due to improper sanitization of user input.
CVE-2024-43800	MEDIUM	[serve-static] serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.
AIKIDO-2024-10254	LOW	[serve-static] Affected versions of the package are vulnerable to Cross-site Scripting (XSS) via the redirect function due to improper sanitization of user input.
AIKIDO-2026-10046	MEDIUM	[pino] Prototype pollution vulnerability in transport loading mechanism via unsafe globalThis.__bundlerPathsOverrides access allows attackers to manipulate the prototype chain and alter application behavior.
AIKIDO-2024-10181	LOW	[path-to-regexp] The patched version adds a strict option to detect potential ReDoS issues. A bad regular expression is generated whenever two parameters within a single segment are separated by something other than a period (.). For example, /:a-:b.
CVE-2024-45296	LOW	[path-to-regexp] A vulnerability in path-to-regexp can generate inefficient regular expressions when two parameters exist in a single segment separated by non-period characters, causing ReDoS and blocking the JavaScript event loop, leading to denial of service.
CVE-2024-52798	LOW	[path-to-regexp] A regular expression generated by this package is vulnerable to catastrophic backtracking, allowing attackers to cause denial of service through ReDoS attacks. This is an incomplete fix for a prior vulnerability.
CVE-2026-4867	LOW	[path-to-regexp] A bad regular expression is generated when three or more parameters exist in a single segment separated by non-period characters, causing catastrophic backtracking and potential ReDoS (Regular Expression Denial of Service) attacks. This vulnerability can lead to severe performance degradation or denial of service when processing malicious URLs.
CVE-2026-26996	LOW	[minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs.
CVE-2026-27903	LOW	[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems.
CVE-2026-27904	LOW	[minimatch] Nested extglobs (*() and +()) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.
CVE-2024-47764	LOW	[cookie] A vulnerability allows attackers to manipulate cookie fields by injecting malicious values into the name, path, or domain parameters, potentially altering cookie behavior and bypassing security controls.
AIKIDO-2025-10094	LOW	[@octokit/endpoint] Improper header parsing for GraphQL endpoints allows attackers to craft malicious inputs triggering ReDoS through excessive regex backtracking, causing denial of service and performance degradation.
CVE-2025-7339	LOW	[on-headers] A bug causes response headers to be inadvertently modified when an array is passed to response.writeHead(), potentially leading to information disclosure or security bypass through header manipulation.
CVE-2025-69873	LOW	[ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort.
AIKIDO-2026-273849	LOW	[ajv] A prototype pollution vulnerability allows attackers to bypass format validation when the $data option is enabled by using inherited property names like constructor or toString as format values, causing unexpected validation behavior or errors.
CVE-2025-25288	LOW	[@octokit/plugin-paginate-rest] A ReDoS (Regular Expression Denial of Service) vulnerability exists in the pagination iterator when processing malicious link headers, allowing attackers to cause denial of service through specially crafted requests.
CVE-2025-25290	LOW	[@octokit/request] A ReDoS vulnerability in the link header parsing regex allows attackers to cause excessive CPU usage and service unavailability through specially crafted HTTP responses. The unbounded regex pattern is susceptible to catastrophic backtracking when processing malicious input.
CVE-2025-25289	LOW	[@octokit/request-error] A Regular Expression Denial of Service (ReDoS) vulnerability in HTTP header processing allows attackers to cause excessive resource consumption and DoS by sending malformed authorization headers with long space sequences. This can significantly degrade performance or crash services.

🔗 Related Tasks

• https://linear.app/honestbank/issue/SEC-400/minor-upgrade-for-form-data
• https://linear.app/honestbank/issue/SEC-292/major-upgrade-for-tough-cookie
• https://linear.app/honestbank/issue/SEC-464/small-upgrade-for-jws
• https://linear.app/honestbank/issue/SEC-478/minor-upgrade-for-qs
• https://linear.app/honestbank/issue/SEC-527/minor-upgrade-for-lodash
• https://linear.app/honestbank/issue/SEC-542/small-upgrade-for-minimatch
• https://linear.app/honestbank/issue/SEC-521/small-upgrade-for-handlebars
• https://linear.app/honestbank/issue/SEC-604/major-upgrade-for-uuid