From 80865a7ec4d2a5e053874601d43906b878db5a8e Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Sun, 6 Sep 2026 05:57:04 +0000 Subject: [PATCH] EDM-5555: patch CVE-2026-84292 fast-uri Authority Injection Add npm override to pin fast-uri to 3.1.7, fixing CVE-2026-84292 (CVSS 7.5 HIGH). fast-uri < 3.1.7 serializes the port component of a URI without validation, allowing authority injection via unvalidated port serialization. Strategy: npm override (lowest risk). fast-uri 3.1.7 is within the existing ^3.0.1 semver range. Follows the project's existing override pattern for js-yaml and immutable. Resolves: https://redhat.atlassian.net/browse/EDM-5555 Co-Authored-By: Claude Opus 4.6 --- package-lock.json | 6 +++--- package.json | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 0d5a9e6bb..90d449546 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9561,9 +9561,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.6", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz", - "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index a75b59ab5..b0a073ee6 100644 --- a/package.json +++ b/package.json @@ -57,6 +57,7 @@ }, "overrides": { "js-yaml": "4.3.2", - "immutable": "4.3.9" + "immutable": "4.3.9", + "fast-uri": "3.1.7" } }