Source: node-ajv Version: 8.20.0~ds+~cs7.1.5-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for node-ajv. node-ajv/8.20.0~ds+~cs7.1.5-1 provides fast-uri 4.1.4 only afaics, so needs an update. CVE-2026-86472[0]: | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used | by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through | 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to | lowercase before it percent-decodes the host, so a percent-encoded | uppercase octet such as %41 decodes to a literal A that is never | folded. For a scheme-relative reference such as //host there is no | scheme, so the host canonicalization that would normally repair this | does not run, and parse, normalize, and equal then disagree on the | same host. An application that makes a case-sensitive host decision | on fast-uri output, for example a host allowlist or denylist that | compares the parsed host or uses equal, can be steered past the | check with a percent-encoded uppercase octet, and because hostnames | are case-insensitive in DNS and HTTP the evading spelling still | reaches the host the check meant to gate. The issue is fixed in | fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of | those versions or later. As a workaround, compare hosts case- | insensitively by lowercasing the parsed host before any allowlist or | denylist decision. CVE-2026-86818[1]: | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used | by Fastify and ajv, that added a mailto scheme parser in version | 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each | query field name to the reserved names to, subject, and body while | the name is still percent-encoded, and decodes it only when storing | it as a generic header, so a percent-encoded spelling of a reserved | field name is not recognized as that field at parse time but is re- | emitted as the literal field name when the parsed URI is serialized. | An application that validates, logs, or displays the recipient list | from the first parse and then serializes the URI and sends it can | silently gain an attacker-chosen recipient, and the subject and body | fields can be smuggled across the same roundtrip. The issue is fixed | in fast-uri 4.1.5, and users should upgrade to 4.1.5 or later. As a | workaround, do not act on a mailto URI that fast-uri has re- | serialized without first decoding and re-validating its recipient, | subject, and body fields. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-86472 https://www.cve.org/CVERecord?id=CVE-2026-86472 [1] https://security-tracker.debian.org/tracker/CVE-2026-86818 https://www.cve.org/CVERecord?id=CVE-2026-86818 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
