[From nobody Fri Sep 18 06:35:04 2026 Received: (at submit) by bugs.debian.org; 17 Sep 2026 20:59:13 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 17; hammy, 150; neutral, 130; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1x7JCJ-000OaR-1h for submit@bugs.debian.org; Thu, 17 Sep 2026 20:59:12 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: node-ajv: fast-uri: CVE-2026-86472 CVE-2026-86818 Message-ID: <178967875044.33889.8473890964093178659.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Thu, 17 Sep 2026 22:59:10 +0200 Delivered-To: submit@bugs.debian.org Source: node-ajv Version: 8.20.0~ds+~cs7.1.5-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerabilities were published for node-ajv. node-ajv/8.20.0~ds+~cs7.1.5-1 provides fast-uri 4.1.4 only afaics, so needs an update. CVE-2026-86472[0]: | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used | by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through | 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to | lowercase before it percent-decodes the host, so a percent-encoded | uppercase octet such as %41 decodes to a literal A that is never | folded. For a scheme-relative reference such as //host there is no | scheme, so the host canonicalization that would normally repair this | does not run, and parse, normalize, and equal then disagree on the | same host. An application that makes a case-sensitive host decision | on fast-uri output, for example a host allowlist or denylist that | compares the parsed host or uses equal, can be steered past the | check with a percent-encoded uppercase octet, and because hostnames | are case-insensitive in DNS and HTTP the evading spelling still | reaches the host the check meant to gate. The issue is fixed in | fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of | those versions or later. As a workaround, compare hosts case- | insensitively by lowercasing the parsed host before any allowlist or | denylist decision. CVE-2026-86818[1]: | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used | by Fastify and ajv, that added a mailto scheme parser in version | 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each | query field name to the reserved names to, subject, and body while | the name is still percent-encoded, and decodes it only when storing | it as a generic header, so a percent-encoded spelling of a reserved | field name is not recognized as that field at parse time but is re- | emitted as the literal field name when the parsed URI is serialized. | An application that validates, logs, or displays the recipient list | from the first parse and then serializes the URI and sends it can | silently gain an attacker-chosen recipient, and the subject and body | fields can be smuggled across the same roundtrip. The issue is fixed | in fast-uri 4.1.5, and users should upgrade to 4.1.5 or later. As a | workaround, do not act on a mailto URI that fast-uri has re- | serialized without first decoding and re-validating its recipient, | subject, and body fields. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-86472 https://www.cve.org/CVERecord?id=CVE-2026-86472 [1] https://security-tracker.debian.org/tracker/CVE-2026-86818 https://www.cve.org/CVERecord?id=CVE-2026-86818 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]