Your message dated Fri, 04 Sep 2026 10:27:02 +0000
with message-id <[email protected]>
and subject line Bug#1146660: fixed in node-ajv 8.20.0~ds+~cs7.1.5-1
has caused the Debian Bug report #1146660,
regarding node-ajv: CVE-2026-84292 CVE-2026-84394
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146660: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146660
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-ajv
Version: 8.20.0~ds+~cs7.1.4-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for node-ajv.
CVE-2026-84292[0]:
| fast-uri serializes the port component of a URI without validating
| it. When recomposing the authority, the userinfo and host components
| are escaped but the port is concatenated verbatim, so a port value
| that is not a sequence of digits can inject authority delimiters,
| demoting the intended host to userinfo and pointing the authority at
| an attacker-controlled host. Both fast-uri and Node's URL read the
| result back as the attacker's host with no error, so re-validating
| the built URI does not catch it. This affects applications that
| build URIs from parts and assign untrusted data to the port
| component through the serialize, normalize, or equal functions in
| their object forms. The issue affects fast-uri versions before
| 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is
| fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects
| any port that is not a digit sequence per RFC 3986.
CVE-2026-84394[1]:
| fast-uri accepts a host that contains an unbalanced or misplaced
| authority bracket without reporting an error. A host that starts
| with an opening bracket but does not end with a closing bracket is
| neither validated as an IP literal nor canonicalized as a domain
| name, so parse() returns it as the host with error undefined, while
| Node's URL and the HTTP clients built on it resolve the same string
| to a different host. An application that reads the parsed host to
| make a host decision, such as an SSRF denylist, a redirect
| allowlist, or proxy routing, and then passes the original URL to an
| HTTP client evaluates its policy against a string that is not the
| host the request reaches. The same host is carried through
| normalize, equal, and resolve. This affects fast-uri versions 2.4.5,
| 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where
| parse() reports a malformed host for any host that contains a
| bracket but is not a valid IPv6 literal.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-84292
https://www.cve.org/CVERecord?id=CVE-2026-84292
[1] https://security-tracker.debian.org/tracker/CVE-2026-84394
https://www.cve.org/CVERecord?id=CVE-2026-84394
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-ajv
Source-Version: 8.20.0~ds+~cs7.1.5-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-ajv, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-ajv package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 04 Sep 2026 11:16:22 +0200
Source: node-ajv
Architecture: source
Version: 8.20.0~ds+~cs7.1.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1146660
Changes:
node-ajv (8.20.0~ds+~cs7.1.5-1) unstable; urgency=medium
.
* Team upload
* New upstream release (Closes: #1146660, CVE-2026-84292, CVE-2026-84394):
- updates fast-uri to 4.1.4
Checksums-Sha1:
cf88d133f56f3a6223bb91c0bb62dbae8b1ae5e5 2995 node-ajv_8.20.0~ds+~cs7.1.5-1.dsc
e9eb88d2d29bd89c0979db3889d2ac01bef8cb29 15784
node-ajv_8.20.0~ds+~cs7.1.5.orig-ajv-formats.tar.xz
86dda9722d853045e93f581989f2dbfadb516ac4 48496
node-ajv_8.20.0~ds+~cs7.1.5.orig-fast-uri.tar.xz
252fb7dcb0ee564c8ccca05ce47f18a5869e455e 157948
node-ajv_8.20.0~ds+~cs7.1.5.orig.tar.xz
d0ab417709f5d06fed7a852e4d6a356822651496 84136
node-ajv_8.20.0~ds+~cs7.1.5-1.debian.tar.xz
Checksums-Sha256:
25b3310b0cf2d9294a3b6f0a9f70f535da3c51ac36092f75b014ad87b659aa82 2995
node-ajv_8.20.0~ds+~cs7.1.5-1.dsc
cb2d4c8318b09e8dc95400cef30007678adde921f2f96e40555186cf0b284795 15784
node-ajv_8.20.0~ds+~cs7.1.5.orig-ajv-formats.tar.xz
f5be3ee36e1733430626e43452d78915f066ae7bfb191d1627ddd961e211fc2f 48496
node-ajv_8.20.0~ds+~cs7.1.5.orig-fast-uri.tar.xz
dc39049f1740e184d79b4ba4d59b804f7c2dee3885e6eda9fbcfdfeb73799d8f 157948
node-ajv_8.20.0~ds+~cs7.1.5.orig.tar.xz
3d8d099d6540ed827fa8635a10a33d5cf22c4a60d8b453cd3fa7aa3fc0c66946 84136
node-ajv_8.20.0~ds+~cs7.1.5-1.debian.tar.xz
Files:
5e72f9d3d778aa14cac9c2cdf129b5f0 2995 javascript optional
node-ajv_8.20.0~ds+~cs7.1.5-1.dsc
d731ebdc55c16ebfc43bac566641a2bb 15784 javascript optional
node-ajv_8.20.0~ds+~cs7.1.5.orig-ajv-formats.tar.xz
999f6d624072df821df5cf5aa1c0b906 48496 javascript optional
node-ajv_8.20.0~ds+~cs7.1.5.orig-fast-uri.tar.xz
a4bf97e93b7b8a0e274d0267430f0c7b 157948 javascript optional
node-ajv_8.20.0~ds+~cs7.1.5.orig.tar.xz
e796edc184ea9f977737ed467d3471eb 84136 javascript optional
node-ajv_8.20.0~ds+~cs7.1.5-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqajf0ACgkQ9tdMp8mZ
7ukb+hAAiJqRK65eJ1ZIAe5QaSjHNuGhiwaracgzg5ZLE9oCL9+rd2ulvA3nCEZ1
E9O8eE1C3TBq9rSPKjX5AlL6nX+LTGxhYXBZmeNB5J0gxROGmMOWBOJjiW6V8x8G
70b8uFKmNCeueB2qh2VemW7VMM8iZHMZIg8ksi9zQRkPGHspelqkFvU3PlhV/44o
Ty3lyYJg0hvbX26q60yZY/vy/12pLSsdCQE3s/j2eheyXHVUwoE0fcUjMK7qDQ4O
nixU+X8OhpCh0GlCZCD+aFJy/7JFUkus16Nm+b68QbvcKub/5n8N1WOb2qbs/wId
kLFmFKOa3WZd1IR5vIs26tVRtDd7jS2ZLKmlNuJViZSq7CUHs79DMqx4Z2TYN2uy
ksMMQ9NdJAiw0m1nc+vmlU3RHKdXmun+2STIN/cX2cH1t0scnwfH4U4JrmLyNKTF
YnT/akfK1NqczRHabV3LnC8+IKGLDb5fmE4Q1MbaPoxiVuokIYOf06O3dM+lMufQ
kSEgSaXV+Q3IJB5PUSARiMR/3j5g+FC6edvj5YDkJgmSMj3gqVHGxBtBAKoGBqSQ
cHD5rkFyqv5OoDOrkE9vji7XK93ZT12TnE+FU7eSCxTGmJzfC/zLas/Llp1yu0fi
YdcEpQYQkExDoBsW6ZxkymoMYrt6fsOR8MqO8eNlumy3nGBysis=
=y8aY
-----END PGP SIGNATURE-----
pgp6PcxbL7lNC.pgp
Description: PGP signature
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
