@forgerock/api-report-0.0.0.tgz: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

[mend-for-github-com]

Vulnerable Library - @⁠forgerock/api-report-0.0.0.tgz

Path to vulnerable library: /package.json

Found in HEAD commit: f705d4d7412e53c157d50f84d63e20205edd37ed

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (@⁠forgerock/api-report version)	Remediation Possible**
CVE-2026-84394	High	7.5	fast-uri-3.1.6.tgz	Transitive	N/A*	❌
CVE-2026-84292	High	7.5	fast-uri-3.1.6.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-84394

Vulnerable Library - fast-uri-3.1.6.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• @⁠forgerock/api-report-0.0.0.tgz (Root Library)
  • api-extractor-7.58.2.tgz
    • tsdoc-config-0.18.1.tgz
      • ajv-8.18.0.tgz
        • ❌ fast-uri-3.1.6.tgz (Vulnerable Library)

Found in HEAD commit: f705d4d7412e53c157d50f84d63e20205edd37ed

Found in base branch: main

Vulnerability Details

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.

Publish Date: 2026-09-02

URL: CVE-2026-84394

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-58mr-gqgx-xq4g

Release Date: 2026-09-02

Fix Resolution: fast-uri - 3.1.7,fast-uri - 2.4.6,fast-uri - 4.1.4,https://github.com/fastify/fast-uri.git - v2.4.6,https://github.com/fastify/fast-uri.git - v3.1.7,https://github.com/fastify/fast-uri.git - v4.1.4

CVE-2026-84292

Vulnerable Library - fast-uri-3.1.6.tgz

Dependency-free RFC 3986 URI toolbox

Library home page: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• @⁠forgerock/api-report-0.0.0.tgz (Root Library)
  • api-extractor-7.58.2.tgz
    • tsdoc-config-0.18.1.tgz
      • ajv-8.18.0.tgz
        • ❌ fast-uri-3.1.6.tgz (Vulnerable Library)

Found in HEAD commit: f705d4d7412e53c157d50f84d63e20205edd37ed

Found in base branch: main

Vulnerability Details

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.

Publish Date: 2026-09-02

URL: CVE-2026-84292

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qw65-cvwx-89v3

Release Date: 2026-09-02

Fix Resolution: fast-uri - 2.4.6,fast-uri - 3.1.7,fast-uri - 4.1.4

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.