fast-uri Override Playground

Emergency security override for CVE-2026-6321 and CVE-2026-6322 — closes #1687, unblocks #1678 and #1686.

Advisories Patched

Advisory	CVE	Severity	Vector
GHSA-q3j6-qgpj-74h6	CVE-2026-6321	High	Path traversal via percent-encoded dot segments
GHSA-v39h-62p7-jpjc	CVE-2026-6322	High	Host confusion via percent-encoded authority delimiters

Dependency Path

orchestkit@7.85.0
└─┬ agentation-mcp@1.2.0
  └─┬ @modelcontextprotocol/sdk@1.29.0
    └─┬ ajv@8.18.0
      └── fast-uri@3.1.2  (was 3.1.0 — vulnerable)

Diff

  "overrides": {
    "hono": "^4.12.18",
    "ip-address": "^10.2.0",
-   "express-rate-limit": "^8.5.1"
+   "express-rate-limit": "^8.5.1",
+   "fast-uri": "^3.1.2"
  }

Verification

Check	Before	After
`npm ls fast-uri`	3.1.0	3.1.2
`npm audit` findings ≥ moderate	2 high	0
`tests/security/test-npm-audit.sh`	FAIL	PASS
`npm run test:security` (14 suites)	13/14	14/14

Unblocks

#1678 — was failing on the same fast-uri audit gate
#1686 — was failing on the same fast-uri audit gate

Pattern Reference

Mirrors PR #1624 (hono / ip-address / express-rate-limit overrides). Same one-line addition to overrides in package.json; npm install regenerates the lockfile; no source-code changes required.

Tracking: M134 — Upgrade to CC 2.1.138 / W7