Homepage

CVE-2026-6321 The advisory has been revoked - it doesn't affect any version of package node-ajv  (opens in a new tab)

Threat Intelligence

EPSS
0.63% (51st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-NODEAJV-16425658
  • published6 May 2026
  • disclosed4 May 2026
Report a new vulnerability Found a mistake?

Introduced: 4 May 2026

CVE-2026-6321  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:11.

NVD Description

Note: Versions mentioned in the description apply only to the upstream node-ajv package and not the node-ajv package as distributed by Debian.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

References