CVE-2026-6322 The advisory has been revoked - it doesn't affect any version of package arangodb-3.12-compat (opens in a new tab)

Threat Intelligence

0.68% (51^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-MINIMOSLATEST-ARANGODB312COMPAT-16732371
published18 May 2026
disclosed5 May 2026

Report a new vulnerability Found a mistake?

Introduced: 5 May 2026

CVE-2026-6322 (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream arangodb-3.12-compat package and not the arangodb-3.12-compat package as distributed by Minimos.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.