From b1ce1b63245d0daa27cab2b1c16a3fc1b8425baf Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Sun, 6 Sep 2026 05:57:04 +0000 Subject: [PATCH] EDM-5555: patch CVE-2026-84292 fast-uri Authority Injection Add npm override to pin fast-uri to 3.1.7, fixing CVE-2026-84292 (CVSS 7.5 HIGH). fast-uri < 3.1.7 serializes the port component of a URI without validation, allowing authority injection via unvalidated port serialization. Strategy: npm override (lowest risk). fast-uri 3.1.7 is within the existing ^3.0.1 semver range. Follows the project's existing override pattern for js-yaml and immutable. Resolves: https://redhat.atlassian.net/browse/EDM-5555 Co-Authored-By: Claude Opus 4.6 --- package-lock.json | 6 +++--- package.json | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9b244a452..10607ef39 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9974,9 +9974,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.6", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz", - "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 828f31419..b227a7ef4 100644 --- a/package.json +++ b/package.json @@ -52,6 +52,7 @@ "lodash": "^4.18.0" }, "overrides": { - "js-yaml": "4.3.2" + "js-yaml": "4.3.2", + "fast-uri": "3.1.7" } }