Source: node-ajv Version: 8.20.0~ds+~cs7.1.6-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for node-ajv. CVE-2026-110180[0]: | fast-uri is a dependency-free RFC 3986 URI parser and serializer for | Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through | 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the | canonicalizeHost() function passes the parsed host to the WHATWG URL | parser and adopts its hostname without checking that the parser | consumed the entire input as a host, so the authority can be | silently rewritten: data before an at-sign is dropped and tab, | carriage-return, and line-feed characters are stripped, with no | error reported. An application that enforces host-based policy such | as denylists, loopback filtering, redirect validation, or outbound | proxy routing on one representation can then see the canonical host | diverge from what it checked, allowing traffic to be steered to an | unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, | and 4.2.3, and users should upgrade to one of these versions or | later. As a workaround, reject an authority that contains more than | one at-sign or any tab, carriage-return, or line-feed before calling | fast-uri, or treat any non-empty parse error as fatal and compare | hosts only from the same parse result. CVE-2026-110306[1]: | fast-uri is a dependency-free RFC 3986 URI parser and serializer for | Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and | from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme | component with the legacy global unescape() function before | validating it, so an input whose decoded scheme is a dangerous token | is emitted as a live scheme even though RFC 3986 does not allow | percent-encoding in a scheme and no other parser accepts it. An | application that screens dangerous schemes on the raw input and then | stores or renders the normalized or resolved result can turn an | inert string into an executable javascript, data, or vbscript URL, | producing a stored or reflected cross-site scripting vector, and the | equal() comparison treats an encoded and a plain scheme as the same, | which can bypass equality-based allowlists. The issue is fixed in | fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of | these versions or later. As a workaround, reject input whose scheme | part contains a percent sign, or check the parsed scheme against an | allowlist after normalization and use that same parsed result rather | than the raw string. CVE-2026-110725[2]: | fast-uri is a dependency-free RFC 3986 URI parser and serializer for | Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and | from 4.0.0 through 4.2.2, when serialize(), normalize(), or | resolve() are called with the non-default option reference set to | suffix on a reference that has no authority, the emitted relative | reference can contain a bare colon in its first path segment without | escaping it, even though RFC 3986 forbids that because it makes the | string reparse as an absolute URI with a scheme. An application that | serializes or normalizes a relative reference with the suffix option | and then treats the result as a URI can turn inert input into a live | javascript, data, or vbscript URL, a cross-site scripting vector, | and the equal() comparison can conflate a scheme-bearing reference | with a relative one. Exposure is limited to applications using the | non-default suffix reference option. The issue is fixed in fast-uri | 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these | versions or later. As a workaround, avoid the suffix reference | option on untrusted input, or percent-encode a colon in the first | path segment of the result before treating it as a URI. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-110180 https://www.cve.org/CVERecord?id=CVE-2026-110180 [1] https://security-tracker.debian.org/tracker/CVE-2026-110306 https://www.cve.org/CVERecord?id=CVE-2026-110306 [2] https://security-tracker.debian.org/tracker/CVE-2026-110725 https://www.cve.org/CVERecord?id=CVE-2026-110725 Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
