Security: fast-uri path traversal and host confusion in backend transitive dependencies

[LucasMaupin]

Summary

fast-uri ≤3.1.1 contains two high-severity CVEs in the backend's transitive dependency tree (pulled in via the fastify dependency chain):

• CWE-22 (CVSS 7.5): Path traversal via percent-encoded dot segments (e.g. %2e%2e/) allows unauthorized file access.
• CWE-436 (CVSS 7.5): Host confusion via percent-encoded authority delimiters enables host header spoofing.

Verify

cd intercom-manager
npm ls fast-uri
npm audit 2>&1 | grep fast-uri

Recommendation

npm audit fix

If the automated fix cannot resolve it, identify which direct dependency pins the old fast-uri version and bump that package.

Related

• Frontend equivalent: Security: fast-uri path traversal and host confusion — update to >=3.1.2 intercom-frontend#644
• General npm audit fix: Security: Run npm audit fix to address 7 high + 8 moderate dependency vulnerabilities #227
• Remaining Fastify CVEs: Security: Remaining Fastify CVEs — malformed Content-Type bypass (GHSA-573f-x89g-hqp9) and X-Forwarded-Proto host spoofing (GHSA-444r-cwp2-x5xf) #255

[birme]

daily-backlog-pr: this bump is already applied by open PR #308 (green CI). Linking that PR to close this issue on merge rather than opening a duplicate; moving to In review.