Your message dated Sun, 30 Aug 2026 20:33:56 +0000
with message-id <[email protected]>
and subject line Bug#1145882: fixed in node-ajv 8.20.0~ds+~cs7.1.4-1
has caused the Debian Bug report #1145882,
regarding node-ajv: CVE-2026-75899 CVE-2026-75931 CVE-2026-75975 CVE-2026-76172
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1145882: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145882
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-ajv
Version: 8.20.0~ds+~cs7.1.3-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for node-ajv.
Unfortunately there was another "batch". They are related to the
embedded and provided fast-uri, could you please check them
individually?
CVE-2026-75899[0]:
| fast-uri is a URI parser for Node.js. It decodes percent escapes in
| a hostname during parsing and then decodes the parsed hostname a
| second time during authority recomposition, so a single call to
| normalize or resolve can turn nested percent-encoded input into a
| different network destination such as a loopback hostname or
| address. For example, a doubly encoded host that spells out a
| loopback name decodes to that live host in one operation, which
| contradicts RFC 3986 section 2.4 that an implementation must not
| decode the same string more than once. An application that
| normalizes or resolves an untrusted HTTP-family URI before outbound
| routing, redirect validation, or a host-policy check can receive a
| destination different from the one the original encoded host
| represented, giving a server-side request forgery and host-policy
| bypass primitive. This is an incomplete-fix variant of
| CVE-2026-6322. The affected versions are 2.4.1 up to but not
| including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up
| to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and
| 4.1.3, which normalize percent escapes once and preserve encoded
| percent signs. Users should upgrade to a patched version.
CVE-2026-75931[1]:
| fast-uri is a URI parser for Node.js. It canonicalizes a host to its
| ASCII form only when the input carries an explicit scheme, so a
| scheme-relative reference such as a host preceded by two slashes is
| returned with its host verbatim and no error set. As a result fast-
| uri's own entry points disagree with each other: parse, resolve,
| normalize, and equal can yield different hosts for the same input
| depending only on whether a scheme is written out, and equal can
| return opposite verdicts for the same pair of hosts. An application
| that extracts a host with fast-uri to check it against a policy list
| and then resolves the same reference can make its decision on one
| host while the destination is another, enabling host confusion and
| policy bypass. The affected versions are 2.4.2 up to but not
| including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up
| to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and
| 4.1.3, which canonicalize the host consistently across the resolve
| path. Users should upgrade to a patched version.
CVE-2026-75975[2]:
| fast-uri is a URI parser for Node.js. Its custom parser for
| bracketed IPv6 literals does not validate the complete IPv6 grammar,
| so invalid trailing text in an authority can be silently discarded
| and a malformed attacker-controlled host is turned into a different
| valid IPv6 destination. For example, a bracketed literal with
| invalid trailing characters is normalized to the unspecified
| address, which a Node HTTP client then connects to a local service
| over loopback, and other malformed literals collapse to private-
| range addresses. No error is set on the parsed result, so an
| application checking the error field cannot detect the rewrite. An
| application that normalizes untrusted URLs before outbound requests,
| redirects, proxy routing, or address-policy enforcement can be
| redirected to a local or private IPv6 target, giving a server-side
| request forgery and address-policy bypass primitive. The affected
| versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but
| not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The
| issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed
| IP literals against the full grammar and mark malformed literals as
| authority errors. Users should upgrade to a patched version.
CVE-2026-76172[3]:
| fast-uri is a URI parser for Node.js. During parsing it runs a
| legacy decoding pass over the scheme component and never re-escapes
| the result, and serialization writes the scheme back out verbatim,
| unlike the host component which is re-escaped. As a result an input
| whose scheme carries percent-encoded slashes parses as a scheme with
| no authority, so the parsed host and error are both undefined, yet
| resolving or normalizing that same input emits a network-path
| reference whose authority is attacker-chosen and re-parses to that
| host. An application that allowlists on the parsed host, or treats a
| reference with no authority as safe to resolve against its base,
| gets the opposite of what it checked, giving an off-site redirect,
| server-side request forgery, or address-policy bypass. The legacy
| decoder also expands non-standard escape forms, widening the issue
| past upstream filters, and control characters in the scheme can
| reach the output as raw carriage return and line feed. The affected
| versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but
| not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The
| issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme
| that is not valid after decoding. Users should upgrade to a patched
| version.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-75899
https://www.cve.org/CVERecord?id=CVE-2026-75899
[1] https://security-tracker.debian.org/tracker/CVE-2026-75931
https://www.cve.org/CVERecord?id=CVE-2026-75931
[2] https://security-tracker.debian.org/tracker/CVE-2026-75975
https://www.cve.org/CVERecord?id=CVE-2026-75975
[3] https://security-tracker.debian.org/tracker/CVE-2026-76172
https://www.cve.org/CVERecord?id=CVE-2026-76172
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-ajv
Source-Version: 8.20.0~ds+~cs7.1.4-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-ajv, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-ajv package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 30 Aug 2026 22:08:55 +0200
Source: node-ajv
Architecture: source
Version: 8.20.0~ds+~cs7.1.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1145882
Changes:
node-ajv (8.20.0~ds+~cs7.1.4-1) unstable; urgency=medium
.
* Team upload
* New upstream release (Closes: #1145882, CVE-2026-75899, CVE-2026-75931,
CVE-2026-75975, CVE-2026-76172):
- updates fast-uri to 4.1.3
Checksums-Sha1:
f70eb353c0c300cec09195e842f219d2f69a396a 2995 node-ajv_8.20.0~ds+~cs7.1.4-1.dsc
e9eb88d2d29bd89c0979db3889d2ac01bef8cb29 15784
node-ajv_8.20.0~ds+~cs7.1.4.orig-ajv-formats.tar.xz
3da2045a06024d8309c3979eb2c3bba0cb43a6ac 47800
node-ajv_8.20.0~ds+~cs7.1.4.orig-fast-uri.tar.xz
252fb7dcb0ee564c8ccca05ce47f18a5869e455e 157948
node-ajv_8.20.0~ds+~cs7.1.4.orig.tar.xz
241a6ed43451f5b8b33996ff5a31d076d478fb7d 84148
node-ajv_8.20.0~ds+~cs7.1.4-1.debian.tar.xz
Checksums-Sha256:
96441272b90435243737291f65c22fa9a8ffe10275308a5f7b00851afd782b60 2995
node-ajv_8.20.0~ds+~cs7.1.4-1.dsc
cb2d4c8318b09e8dc95400cef30007678adde921f2f96e40555186cf0b284795 15784
node-ajv_8.20.0~ds+~cs7.1.4.orig-ajv-formats.tar.xz
6848af9b4e0668deafe6ce53ede57d317bd99dbfa065a7a4c87c4735d283f509 47800
node-ajv_8.20.0~ds+~cs7.1.4.orig-fast-uri.tar.xz
dc39049f1740e184d79b4ba4d59b804f7c2dee3885e6eda9fbcfdfeb73799d8f 157948
node-ajv_8.20.0~ds+~cs7.1.4.orig.tar.xz
b9d7745e4f9ebb67218c57bcaaaf0458162cc49cf55300a1aa2082b40213b06d 84148
node-ajv_8.20.0~ds+~cs7.1.4-1.debian.tar.xz
Files:
42fc45736a32dea919c3d72fb9412e54 2995 javascript optional
node-ajv_8.20.0~ds+~cs7.1.4-1.dsc
d731ebdc55c16ebfc43bac566641a2bb 15784 javascript optional
node-ajv_8.20.0~ds+~cs7.1.4.orig-ajv-formats.tar.xz
a4e2fd50edc040c538d09ac31ffc51de 47800 javascript optional
node-ajv_8.20.0~ds+~cs7.1.4.orig-fast-uri.tar.xz
a4bf97e93b7b8a0e274d0267430f0c7b 157948 javascript optional
node-ajv_8.20.0~ds+~cs7.1.4.orig.tar.xz
4da5c4e18576ed0f164d8e7702881328 84148 javascript optional
node-ajv_8.20.0~ds+~cs7.1.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqUjngACgkQ9tdMp8mZ
7ukt+w//daspnfkvOc1mi0GtzDrrgYZBA4NjDb/MVYNT1tC5OBAog1RwrYvvqXV1
DZ1qGzYspopAqTAOdjoN8b+F/XuB+5J6kRfJljsS0bwklwXloNoUUCYNDxxKVr3H
T8DlXVyk7tDbLjMwwHAr0maK5MV33F4PebSbP7X7ytmaxInzJgaDvvoqRGlGm4WY
QkWE9i+hgvj401hgdyrEl8j90Mx9TndEMz5MYeoc8psVLWsGLsv27DAG3lFXefgD
dXewz5foS0b2eamAUIgoInhT0fgttYdiK1trYJplV7oQy+As+wSj2+1SkIcfwLmQ
YGJYcSTpaC+369O7p03CAbR1VA+lqMxmxFeLPBWnv4zheTVRBoJHNG081ft2osl4
TDcSROdxfl6TKzVCGmePcYvsDfMYawPgyhFAabYc3qRmW0pLji+Mex1oKyqiar1w
unTqZ8A4bZ+nqsNC980vcPs5ulDNNVB/MRscxHcdeEEFvTNKwgpR51j66dgmtPe+
NqqOJdwCV0V3gZOu/ypA1TUfK5xPT+3T/6NSIx1rO8XgFQ5mdM9mBecgx8gusWBv
xiomiy/zfpgRiHuFM+hPNcyWTS0dFlJplwJYdkj41eelUPLfR/5gpgkzIGcrGv40
a0EScn+GPnOvlzdglh9LPUQGqflpWAgvISmv7dj/35P5V4BJCto=
=GbV+
-----END PGP SIGNATURE-----
pgpprGt8XtABp.pgp
Description: PGP signature
--- End Message ---
