[From nobody Fri Sep 4 11:29:06 2026 Received: (at submit) by bugs.debian.org; 4 Sep 2026 08:52:50 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 17; hammy, 150; neutral, 117; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1x2PfD-00539u-0z for submit@bugs.debian.org; Fri, 04 Sep 2026 08:52:50 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: node-ajv: CVE-2026-84292 CVE-2026-84394 Message-ID: <178851196554.848849.11616451775119136520.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Fri, 04 Sep 2026 10:52:45 +0200 Delivered-To: submit@bugs.debian.org Source: node-ajv Version: 8.20.0~ds+~cs7.1.4-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerabilities were published for node-ajv. CVE-2026-84292[0]: | fast-uri serializes the port component of a URI without validating | it. When recomposing the authority, the userinfo and host components | are escaped but the port is concatenated verbatim, so a port value | that is not a sequence of digits can inject authority delimiters, | demoting the intended host to userinfo and pointing the authority at | an attacker-controlled host. Both fast-uri and Node's URL read the | result back as the attacker's host with no error, so re-validating | the built URI does not catch it. This affects applications that | build URIs from parts and assign untrusted data to the port | component through the serialize, normalize, or equal functions in | their object forms. The issue affects fast-uri versions before | 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is | fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects | any port that is not a digit sequence per RFC 3986. CVE-2026-84394[1]: | fast-uri accepts a host that contains an unbalanced or misplaced | authority bracket without reporting an error. A host that starts | with an opening bracket but does not end with a closing bracket is | neither validated as an IP literal nor canonicalized as a domain | name, so parse() returns it as the host with error undefined, while | Node's URL and the HTTP clients built on it resolve the same string | to a different host. An application that reads the parsed host to | make a host decision, such as an SSRF denylist, a redirect | allowlist, or proxy routing, and then passes the original URL to an | HTTP client evaluates its policy against a string that is not the | host the request reaches. The same host is carried through | normalize, equal, and resolve. This affects fast-uri versions 2.4.5, | 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where | parse() reports a malformed host for any host that contains a | bracket but is not a valid IPv6 literal. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-84292 https://www.cve.org/CVERecord?id=CVE-2026-84292 [1] https://security-tracker.debian.org/tracker/CVE-2026-84394 https://www.cve.org/CVERecord?id=CVE-2026-84394 Regards, Salvatore ]