chore: update fast-uri (CVE-2026-16221)

[trm-security-agent]

Security Vulnerability Fix

🔒 Vulnerability Summary

CVE ID: CVE-2026-16221
Severity: High
Package: fast-uri
CVSS Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Description

A host confusion vulnerability exists in fast-uri due to improper handling of literal backslash characters as authority delimiters. Unlike Node's WHATWG URL parser, fast-uri does not treat backslash as a delimiter, which creates a parsing discrepancy. An attacker can exploit this to redirect requests to unintended destinations, potentially bypassing security controls such as host allowlists, SSRF filtering, or redirect validation.

CWE: CWE-436 (Interpretation Conflict)

---

🔄 Changes Made

Dependency Update

• Package: fast-uri
• Previous Version: 3.1.0 (resolved in yarn.lock); overrides/resolutions were set to 3.1.2
• Wiz Recommended Version: 3.1.4
• Actual Version Applied: 3.1.4
• Update Type: Patch

Version Selection Rationale

Version 3.1.4 is the latest available patch release within the 3.1.x line and is the exact version that addresses CVE-2026-16221. There are no newer patch releases in the 3.x major line (4.x exists but would be a major version bump). This is the optimal choice — it includes the security fix with minimal risk of breaking changes.

Files Modified

• docs/docusaurus/package.json — Updated overrides and resolutions for fast-uri from 3.1.2 to 3.1.4
• docs/docusaurus/yarn.lock — Regenerated to resolve fast-uri@3.1.4

---

🛡️ Security Impact

What This Fixes

1. The Vulnerability: fast-uri fails to treat literal backslash characters (\) as authority delimiters when parsing URIs, unlike Node's built-in WHATWG URL parser. This interpretation conflict (CWE-436) allows crafted URLs to resolve to different hosts depending on which parser is used.
2. The Risk: An attacker could craft URLs that bypass host-based security controls (allowlists, SSRF filters, redirect validation) by exploiting the parsing discrepancy between fast-uri and Node's URL implementation. This could lead to SSRF attacks or open redirects.
3. The Fix: Version 3.1.4 corrects the backslash handling to align with the WHATWG URL standard, eliminating the host confusion vector.

Breaking Changes

• This is a backward-compatible security patch
• This update includes breaking changes

Affected Components

fast-uri is a transitive dependency pulled in by ajv (JSON schema validator), which is used throughout the Docusaurus documentation build pipeline. It is not used in the StarRocks backend or frontend application code.

---

✅ Validation

Automated Checks

• Dependency version updated in manifest (package.json overrides + resolutions)
• Lock file regenerated successfully (yarn.lock)
• Verified only one copy of fast-uri exists in lock file, resolved to 3.1.4
• Lock file changes are minimal (89 lines diff, mostly the targeted package)

Compatibility Assessment

This is a patch-level update within the same minor version (3.1.x). The fast-uri changelog shows versions 3.1.2, 3.1.3, and 3.1.4 are all security releases with no API changes.

---

📚 References

• CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2026-16221
• OSV Entry: https://osv.dev/vulnerability/CVE-2026-16221
• Package Releases: https://github.com/fastify/fast-uri/releases
• JIRA Ticket: security-agent

---

🤖 Automation Note

This PR was automatically generated by TRM Security Agent (PATCH skill).
For questions or issues, please contact the Security or DevOps team.

---

📋 Reviewer Checklist

• Verified the CVE details and severity assessment
• Reviewed the package changelog for breaking changes
• Confirmed the updated version resolves the vulnerability
• Checked for any compatibility concerns
• Approved for deployment