Source: node-ajv Version: 8.20.0~ds+~cs7.1.4-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for node-ajv. CVE-2026-84292[0]: | fast-uri serializes the port component of a URI without validating | it. When recomposing the authority, the userinfo and host components | are escaped but the port is concatenated verbatim, so a port value | that is not a sequence of digits can inject authority delimiters, | demoting the intended host to userinfo and pointing the authority at | an attacker-controlled host. Both fast-uri and Node's URL read the | result back as the attacker's host with no error, so re-validating | the built URI does not catch it. This affects applications that | build URIs from parts and assign untrusted data to the port | component through the serialize, normalize, or equal functions in | their object forms. The issue affects fast-uri versions before | 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is | fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects | any port that is not a digit sequence per RFC 3986. CVE-2026-84394[1]: | fast-uri accepts a host that contains an unbalanced or misplaced | authority bracket without reporting an error. A host that starts | with an opening bracket but does not end with a closing bracket is | neither validated as an IP literal nor canonicalized as a domain | name, so parse() returns it as the host with error undefined, while | Node's URL and the HTTP clients built on it resolve the same string | to a different host. An application that reads the parsed host to | make a host decision, such as an SSRF denylist, a redirect | allowlist, or proxy routing, and then passes the original URL to an | HTTP client evaluates its policy against a string that is not the | host the request reaches. The same host is carried through | normalize, equal, and resolve. This affects fast-uri versions 2.4.5, | 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where | parse() reports a malformed host for any host that contains a | bracket but is not a valid IPv6 literal. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-84292 https://www.cve.org/CVERecord?id=CVE-2026-84292 [1] https://security-tracker.debian.org/tracker/CVE-2026-84394 https://www.cve.org/CVERecord?id=CVE-2026-84394 Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
