[Git][security-tracker-team/security-tracker][master] Add two node-ajv issues (providing fast-uri)

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e6814e43 by Salvatore Bonaccorso at 2026-09-04T10:52:13+02:00
Add two node-ajv issues (providing fast-uri)

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -669,9 +669,17 @@ CVE-2026-84736 (In the current development version of Eclipse aeriOS, for which
 CVE-2026-84452 (Windows ML CLI is a command line tool for building portable, performan ...)
 	NOT-FOR-US: Windows ML CLI
 CVE-2026-84394 (fast-uri accepts a host that contains an unbalanced or misplaced autho ...)
-	TODO: check
+	- node-ajv <unfixed>
+	[trixie] - node-ajv <no-dsa> (Minor issue)
+	[bookworm] - node-ajv <not-affected> (fast-uri not present)
+	NOTE: https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g
+	NOTE: Embedded fast-uri used and provided as node-fast-uri, starting with forky
 CVE-2026-84292 (fast-uri serializes the port component of a URI without validating it. ...)
-	TODO: check
+	- node-ajv <unfixed>
+	[trixie] - node-ajv <no-dsa> (Minor issue)
+	[bookworm] - node-ajv <not-affected> (fast-uri not present)
+	NOTE: https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3
+	NOTE: Embedded fast-uri used and provided as node-fast-uri, starting with forky
 CVE-2026-84238 (Unauthenticated Broken Access Control in YITH Request a Quote for WooC ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-84215 (Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e6814e4349e4dfadb59c7e5455fe02a4a09159bd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e6814e4349e4dfadb59c7e5455fe02a4a09159bd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260904/706f21c4/attachment.htm>