Your message dated Sat, 24 Oct 2026 15:34:16 +0000
with message-id <[email protected]>
and subject line Bug#1151875: fixed in node-ajv 8.20.0~ds+~cs7.2.4-1
has caused the Debian Bug report #1151875,
regarding node-ajv: CVE-2026-110180 CVE-2026-110306 CVE-2026-110725
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151875: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151875
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-ajv
Version: 8.20.0~ds+~cs7.1.6-2
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerabilities were published for node-ajv.
CVE-2026-110180[0]:
| fast-uri is a dependency-free RFC 3986 URI parser and serializer for
| Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through
| 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the
| canonicalizeHost() function passes the parsed host to the WHATWG URL
| parser and adopts its hostname without checking that the parser
| consumed the entire input as a host, so the authority can be
| silently rewritten: data before an at-sign is dropped and tab,
| carriage-return, and line-feed characters are stripped, with no
| error reported. An application that enforces host-based policy such
| as denylists, loopback filtering, redirect validation, or outbound
| proxy routing on one representation can then see the canonical host
| diverge from what it checked, allowing traffic to be steered to an
| unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9,
| and 4.2.3, and users should upgrade to one of these versions or
| later. As a workaround, reject an authority that contains more than
| one at-sign or any tab, carriage-return, or line-feed before calling
| fast-uri, or treat any non-empty parse error as fatal and compare
| hosts only from the same parse result.
CVE-2026-110306[1]:
| fast-uri is a dependency-free RFC 3986 URI parser and serializer for
| Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and
| from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme
| component with the legacy global unescape() function before
| validating it, so an input whose decoded scheme is a dangerous token
| is emitted as a live scheme even though RFC 3986 does not allow
| percent-encoding in a scheme and no other parser accepts it. An
| application that screens dangerous schemes on the raw input and then
| stores or renders the normalized or resolved result can turn an
| inert string into an executable javascript, data, or vbscript URL,
| producing a stored or reflected cross-site scripting vector, and the
| equal() comparison treats an encoded and a plain scheme as the same,
| which can bypass equality-based allowlists. The issue is fixed in
| fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of
| these versions or later. As a workaround, reject input whose scheme
| part contains a percent sign, or check the parsed scheme against an
| allowlist after normalization and use that same parsed result rather
| than the raw string.
CVE-2026-110725[2]:
| fast-uri is a dependency-free RFC 3986 URI parser and serializer for
| Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and
| from 4.0.0 through 4.2.2, when serialize(), normalize(), or
| resolve() are called with the non-default option reference set to
| suffix on a reference that has no authority, the emitted relative
| reference can contain a bare colon in its first path segment without
| escaping it, even though RFC 3986 forbids that because it makes the
| string reparse as an absolute URI with a scheme. An application that
| serializes or normalizes a relative reference with the suffix option
| and then treats the result as a URI can turn inert input into a live
| javascript, data, or vbscript URL, a cross-site scripting vector,
| and the equal() comparison can conflate a scheme-bearing reference
| with a relative one. Exposure is limited to applications using the
| non-default suffix reference option. The issue is fixed in fast-uri
| 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these
| versions or later. As a workaround, avoid the suffix reference
| option on untrusted input, or percent-encode a colon in the first
| path segment of the result before treating it as a URI.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-110180
https://www.cve.org/CVERecord?id=CVE-2026-110180
[1] https://security-tracker.debian.org/tracker/CVE-2026-110306
https://www.cve.org/CVERecord?id=CVE-2026-110306
[2] https://security-tracker.debian.org/tracker/CVE-2026-110725
https://www.cve.org/CVERecord?id=CVE-2026-110725
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-ajv
Source-Version: 8.20.0~ds+~cs7.2.4-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-ajv, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-ajv package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 17:06:54 +0200
Source: node-ajv
Architecture: source
Version: 8.20.0~ds+~cs7.2.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1151875
Changes:
node-ajv (8.20.0~ds+~cs7.2.4-1) unstable; urgency=medium
.
* Team upload
* New upstream version
(Closes: #1151875, CVE-2026-110180, CVE-2026-110306, CVE-2026-110725)
Checksums-Sha1:
3638868c6937177a6bcaa1d5f0d5e3d670f6c278 3019 node-ajv_8.20.0~ds+~cs7.2.4-1.dsc
e9eb88d2d29bd89c0979db3889d2ac01bef8cb29 15784
node-ajv_8.20.0~ds+~cs7.2.4.orig-ajv-formats.tar.xz
71243a236ee6e16fe8562f1e60543e11210bc0f1 60820
node-ajv_8.20.0~ds+~cs7.2.4.orig-fast-uri.tar.xz
252fb7dcb0ee564c8ccca05ce47f18a5869e455e 157948
node-ajv_8.20.0~ds+~cs7.2.4.orig.tar.xz
95dbc7e436ca6df9a2a4f62969f9e2b3b8469226 84300
node-ajv_8.20.0~ds+~cs7.2.4-1.debian.tar.xz
Checksums-Sha256:
7334ebc9d45aca3d99e80313cbb219e6664c76a52f73d354e8f127253b11b7f1 3019
node-ajv_8.20.0~ds+~cs7.2.4-1.dsc
cb2d4c8318b09e8dc95400cef30007678adde921f2f96e40555186cf0b284795 15784
node-ajv_8.20.0~ds+~cs7.2.4.orig-ajv-formats.tar.xz
b294111e0ff49f6b61cc8aaec4ea004cf0cc0a20ad9f41d8bc189e1fe297cbe4 60820
node-ajv_8.20.0~ds+~cs7.2.4.orig-fast-uri.tar.xz
dc39049f1740e184d79b4ba4d59b804f7c2dee3885e6eda9fbcfdfeb73799d8f 157948
node-ajv_8.20.0~ds+~cs7.2.4.orig.tar.xz
40595254b6a944a9c0b393b37dd7b6b0e81eae57c1712e7e8dc3b1bcd686f505 84300
node-ajv_8.20.0~ds+~cs7.2.4-1.debian.tar.xz
Files:
1cb7b007dad39905c504e5b87a027e34 3019 javascript optional
node-ajv_8.20.0~ds+~cs7.2.4-1.dsc
d731ebdc55c16ebfc43bac566641a2bb 15784 javascript optional
node-ajv_8.20.0~ds+~cs7.2.4.orig-ajv-formats.tar.xz
398493c96672eba51c816f01384e6fe8 60820 javascript optional
node-ajv_8.20.0~ds+~cs7.2.4.orig-fast-uri.tar.xz
a4bf97e93b7b8a0e274d0267430f0c7b 157948 javascript optional
node-ajv_8.20.0~ds+~cs7.2.4.orig.tar.xz
cd5a5c999864aa4afc4938de7d0d411b 84300 javascript optional
node-ajv_8.20.0~ds+~cs7.2.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrcykYACgkQ9tdMp8mZ
7um17hAAhRjY7XZllqs52kUm5MR4e4BivREYjKifiVMuA1yBiGnI87gOJXk7AZsf
c01b2RGgDng1wZB+m21gsU+NvkClYUXoVhuvZ5TU96R3iLzPDRIk7Vrdj5aMRMfV
HhGW/g/eldazNlCf7Sl1rC2U2CBaT76+GJekjvjNPgLFAxgSYQXk6TjExjctZvnO
U2WB3X+zF4Q3Zx0nxC1bylR2EHovA74vfio09Rm2GRUYV2K6Skw6Big1m2ZcJ7Tw
4Dek5lqy8Oo3sXp+tP/DjRpn+AMzqW3j9/1DmwbvmMLuCpfC42QGLzkKY2W+Pbq2
TopPEsQM3V5bXaY6tpu3zBOMJH5D+M/pPyue3J4pHjsxhy0Esu/2OcMn4xEgLFbB
UgTgqUnq8TIjHvWIvb4E5LfmT/GayJxu1tysfGNj4OchgEcJVWHy+kU/fp+FKkds
bhD+GE7UEJVo8NpSMdilHyeqxD5QrmeBlLMCH+lrSSctT4LosNlNuVe9lOG58hjE
EC0JG8Bzscc6poiSaVYu5OsC79yu9mPFo2OyZ2AGfXtS3RhSV6N9t2OB7HQZBtSn
dKSw5dx51vNPWDYE9p3AglnCE6gyDGp9BsTkUPO+8yqAW1+dHpt/pZLqx/uVfC3M
6Q4GIow1YMAcb8yzjZeN9qFhAoRwEghN+C4rN40Ziibez8Yv8JE=
=SJkL
-----END PGP SIGNATURE-----
pgprPXe8_gwUV.pgp
Description: PGP signature
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
