Hi,

The following vulnerabilities were published for node-ajv.

CVE-2026-84292[0]:
| fast-uri serializes the port component of a URI without validating
| it. When recomposing the authority, the userinfo and host components
| are escaped but the port is concatenated verbatim, so a port value
| that is not a sequence of digits can inject authority delimiters,
| demoting the intended host to userinfo and pointing the authority at
| an attacker-controlled host. Both fast-uri and Node's URL read the
| result back as the attacker's host with no error, so re-validating
| the built URI does not catch it. This affects applications that
| build URIs from parts and assign untrusted data to the port
| component through the serialize, normalize, or equal functions in
| their object forms. The issue affects fast-uri versions before
| 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is
| fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects
| any port that is not a digit sequence per RFC 3986.


CVE-2026-84394[1]:
| fast-uri accepts a host that contains an unbalanced or misplaced
| authority bracket without reporting an error. A host that starts
| with an opening bracket but does not end with a closing bracket is
| neither validated as an IP literal nor canonicalized as a domain
| name, so parse() returns it as the host with error undefined, while
| Node's URL and the HTTP clients built on it resolve the same string
| to a different host. An application that reads the parsed host to
| make a host decision, such as an SSRF denylist, a redirect
| allowlist, or proxy routing, and then passes the original URL to an
| HTTP client evaluates its policy against a string that is not the
| host the request reaches. The same host is carried through
| normalize, equal, and resolve. This affects fast-uri versions 2.4.5,
| 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where
| parse() reports a malformed host for any host that contains a
| bracket but is not a valid IPv6 literal.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-84292
https://www.cve.org/CVERecord?id=CVE-2026-84292
[1] https://security-tracker.debian.org/tracker/CVE-2026-84394
https://www.cve.org/CVERecord?id=CVE-2026-84394

Regards,
Salvatore

Hello,

Bug #1146660 in node-ajv reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-ajv/-/commit/3fdc1d502763913fc1730edbdc4f0a612fad303e

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1146660

Hello,

Bug #1146660 in node-ajv reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-ajv/-/commit/3fdc1d502763913fc1730edbdc4f0a612fad303e

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1146660

We believe that the bug you reported is fixed in the latest version of
node-ajv, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146660@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-ajv package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 04 Sep 2026 11:16:22 +0200
Source: node-ajv
Architecture: source
Version: 8.20.0~ds+~cs7.1.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1146660
Changes:
 node-ajv (8.20.0~ds+~cs7.1.5-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream release (Closes: #1146660, CVE-2026-84292, CVE-2026-84394):
     - updates fast-uri to 4.1.4
Checksums-Sha1:
 cf88d133f56f3a6223bb91c0bb62dbae8b1ae5e5 2995 node-ajv_8.20.0~ds+~cs7.1.5-1.dsc
 e9eb88d2d29bd89c0979db3889d2ac01bef8cb29 15784 node-ajv_8.20.0~ds+~cs7.1.5.orig-ajv-formats.tar.xz
 86dda9722d853045e93f581989f2dbfadb516ac4 48496 node-ajv_8.20.0~ds+~cs7.1.5.orig-fast-uri.tar.xz
 252fb7dcb0ee564c8ccca05ce47f18a5869e455e 157948 node-ajv_8.20.0~ds+~cs7.1.5.orig.tar.xz
 d0ab417709f5d06fed7a852e4d6a356822651496 84136 node-ajv_8.20.0~ds+~cs7.1.5-1.debian.tar.xz
Checksums-Sha256:
 25b3310b0cf2d9294a3b6f0a9f70f535da3c51ac36092f75b014ad87b659aa82 2995 node-ajv_8.20.0~ds+~cs7.1.5-1.dsc
 cb2d4c8318b09e8dc95400cef30007678adde921f2f96e40555186cf0b284795 15784 node-ajv_8.20.0~ds+~cs7.1.5.orig-ajv-formats.tar.xz
 f5be3ee36e1733430626e43452d78915f066ae7bfb191d1627ddd961e211fc2f 48496 node-ajv_8.20.0~ds+~cs7.1.5.orig-fast-uri.tar.xz
 dc39049f1740e184d79b4ba4d59b804f7c2dee3885e6eda9fbcfdfeb73799d8f 157948 node-ajv_8.20.0~ds+~cs7.1.5.orig.tar.xz
 3d8d099d6540ed827fa8635a10a33d5cf22c4a60d8b453cd3fa7aa3fc0c66946 84136 node-ajv_8.20.0~ds+~cs7.1.5-1.debian.tar.xz
Files:
 5e72f9d3d778aa14cac9c2cdf129b5f0 2995 javascript optional node-ajv_8.20.0~ds+~cs7.1.5-1.dsc
 d731ebdc55c16ebfc43bac566641a2bb 15784 javascript optional node-ajv_8.20.0~ds+~cs7.1.5.orig-ajv-formats.tar.xz
 999f6d624072df821df5cf5aa1c0b906 48496 javascript optional node-ajv_8.20.0~ds+~cs7.1.5.orig-fast-uri.tar.xz
 a4bf97e93b7b8a0e274d0267430f0c7b 157948 javascript optional node-ajv_8.20.0~ds+~cs7.1.5.orig.tar.xz
 e796edc184ea9f977737ed467d3471eb 84136 javascript optional node-ajv_8.20.0~ds+~cs7.1.5-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqajf0ACgkQ9tdMp8mZ
7ukb+hAAiJqRK65eJ1ZIAe5QaSjHNuGhiwaracgzg5ZLE9oCL9+rd2ulvA3nCEZ1
E9O8eE1C3TBq9rSPKjX5AlL6nX+LTGxhYXBZmeNB5J0gxROGmMOWBOJjiW6V8x8G
70b8uFKmNCeueB2qh2VemW7VMM8iZHMZIg8ksi9zQRkPGHspelqkFvU3PlhV/44o
Ty3lyYJg0hvbX26q60yZY/vy/12pLSsdCQE3s/j2eheyXHVUwoE0fcUjMK7qDQ4O
nixU+X8OhpCh0GlCZCD+aFJy/7JFUkus16Nm+b68QbvcKub/5n8N1WOb2qbs/wId
kLFmFKOa3WZd1IR5vIs26tVRtDd7jS2ZLKmlNuJViZSq7CUHs79DMqx4Z2TYN2uy
ksMMQ9NdJAiw0m1nc+vmlU3RHKdXmun+2STIN/cX2cH1t0scnwfH4U4JrmLyNKTF
YnT/akfK1NqczRHabV3LnC8+IKGLDb5fmE4Q1MbaPoxiVuokIYOf06O3dM+lMufQ
kSEgSaXV+Q3IJB5PUSARiMR/3j5g+FC6edvj5YDkJgmSMj3gqVHGxBtBAKoGBqSQ
cHD5rkFyqv5OoDOrkE9vji7XK93ZT12TnE+FU7eSCxTGmJzfC/zLas/Llp1yu0fi
YdcEpQYQkExDoBsW6ZxkymoMYrt6fsOR8MqO8eNlumy3nGBysis=
=y8aY
-----END PGP SIGNATURE-----