UID2-7812, UID2-7813, UID2-7814, UID2-7815: suppress 4 CVEs in .trivyignore - #211
Merged
Conversation
…ignore (exp 2026-12-03) - CVE-2026-75899 (UID2-7812) - CVE-2026-75931 (UID2-7813) - CVE-2026-75975 (UID2-7814) - CVE-2026-76172 (UID2-7815) Each is present but not reachable from this service; see the linked tickets for the per-CVE impact assessments. Reachability alone determines suppress-vs-fix.
BehnamMozafari
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Suppresses 4 vulnerabilities in
.trivyignore, expiry 2026-12-03 (3 months). No code fixes — each is present in the image but not reachable from this service.Reachability alone determines suppress-vs-fix: a fixed version existing upstream does not make an unreachable path exploitable. Change any expiry in review if you want a different window.
CVE-2026-75899 — HIGH,
fast-uriThe CVE is an SSRF/host-policy-bypass primitive that only manifests when an application passes an untrusted HTTP-family URI to fast-uri's normalize()/resolve() before outbound routing, redirect validation, or an allowlist check — the double percent-decode then yields a different network host. In every flagged repo, fast-uri 3.1.4 is present solely as a transitive dependency of ajv (JSON-schema validator) reached through build tooling: Docusaurus/webpack schema-utils and ajv-formats for the docs sites, CRA/webpack for the React client examples, craco/webpack for the self-serve portal, and eslint's table>ajv in the server-side example. The package.json fast-uri entries are all
overridessecurity pins, not declared app dependencies, and no *.js/ts/tsx source in any repo imports fast-uri or calls normalize/resolve. ajv uses fast-uri only to resolve developer-authored, trusted schema $ref/$id URIs at build time and makes no outbound network requests based on the decoded host, so the SSRF code path is never exercised on attacker-controlled input. The vulnerable path is unreachable in all five repos.Full triage report — CVE-2026-75899
CVE-2026-75899 — fast-uri SSRF via repeated hostname percent-decoding
Severity: HIGH (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Package: fast-uri Installed: 3.1.4 Fixed in: 2.4.5, 3.1.6, 4.1.3
Verdict: not_affected (suppress)
What the CVE is
fast-uridecodes a hostname's percent escapes twice in a singlenormalize()/resolve()call — once during parsing and again during authority recomposition. A doubly percent-encoded host survives the first decode and is turned into a live destination by the second, e.g.normalize('http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/')returnshttp://localhost/. An application that normalizes/resolves an untrusted URI before an SSRF check, redirect validation, or host allowlist can be steered to an internal destination (loopback, cloud metadata). This is an incomplete-fix variant of CVE-2026-6322. Workaround: reject untrusted URIs whose host contains%25before calling normalize/resolve.How it maps to our repos
fast-uri 3.1.4 (affected) is flagged in EUID-docs, uid2-examples, uid2-self-serve-portal, uid2docs, and uid2-docs-preview. In every case it is a transitive dependency of
ajv(the JSON-schema validator), reached only through build tooling:ajv-formats/node_modules/fast-uriandschema-utils/node_modules/fast-uri— webpack build-time schema validation.node_modules/fast-urideclared as^3.0.1by ajv pulled in by CRA/webpack; the server-side lock gets it via eslint'stable > ajv.The
fast-urilines in eachpackage.jsonareoverridessecurity pins (forcing the transitive version up), not declared application dependencies. A grep across all repos finds no*.js/ts/tsxsource that imports fast-uri or callsnormalize()/resolve().Why not affected
The vulnerable primitive requires normalizing/resolving an untrusted URI ahead of an outbound-routing/allowlist decision. Here fast-uri is exercised only by ajv, which resolves developer-authored, trusted schema
$ref/$idURIs at build time and performs no outbound network request based on the decoded host. No production code path feeds attacker-controlled URIs into fast-uri. The SSRF/host-policy-bypass path is therefore unreachable in all five repos.Decision
Not affected — reachability chain is broken (present but unreachable). Recommend suppressing this finding in each repo's root
.trivyignore. A version bump to a patched fast-uri (via the existing overrides pin) is harmless housekeeping but is not required to remediate risk. Confidence: high.CVE-2026-75931 — HIGH,
fast-uriThe CVE is a host-confusion/policy-bypass bug: an application must call fast-uri's resolve()/parse()/equal() on untrusted scheme-relative references (//host/) and then make a host-policy or routing decision on the returned host. In all five flagged repos fast-uri@3.1.4 is present only as a transitive dependency of ajv (reached through ajv-formats, schema-utils/webpack, react-scripts, and @docusaurus/*), and is additionally carried as an overrides security pin in each package.json. Grep across all non-node_modules source found zero direct imports of fast-uri or ajv, and no repo depends on fastify (count 0 everywhere) — the usual runtime consumer of fast-uri. The three docs repos are static Docusaurus sites; the portal and the uid2-examples apps are React/react-scripts (webpack) builds whose only runtime server (uid2-examples server.js) is a plain Express static file server that never touches ajv/fast-uri. ajv's sole use of fast-uri is resolving $ref URIs in trusted, developer-authored JSON schemas at build time — not resolving attacker-controlled references for host-policy decisions. The vulnerable code path is therefore not reachable in production. A fix exists (3.1.6) but availability does not change reachability, so the finding is suppressed.
Full triage report — CVE-2026-75931
CVE-2026-75931 — fast-uri host confusion via skipped IDN canonicalization
Summary
What the CVE is
fast-uri canonicalizes a host to ASCII form only when the input carries an explicit scheme. For a scheme-relative reference (
//host/),resolve()emits the host verbatim, so re-parsing the resolved URI yields a different host thanresolve()returned. An application that resolves an untrusted reference and then checks or routes on the resulting host can make a policy decision on one host while reaching another (host confusion / policy bypass). Exploitation requires application code to feed untrusted references into fast-uri and use the extracted host for a security decision.How it reaches our repos
fast-uri@3.1.4 was flagged in EUID-docs, uid2-examples, uid2-self-serve-portal, uid2docs, and uid2-docs-preview. In every case it is a transitive dependency of
ajv, pulled in throughajv-formats,schema-utils/webpack,react-scripts, and@docusaurus/*. It is also carried as anoverridessecurity pin in eachpackage.json(forcing the ajv subtree onto a single version), which is why it also surfaces as a top-level entry.Reachability analysis (code search)
node_modulessource found zerorequire('fast-uri')/import ... 'fast-uri'and zero directajvimports in any repo.server.js) is a plain Express static file server that never touches ajv or fast-uri.$refURIs in trusted, developer-authored JSON schemas at build/validation time — not to resolve attacker-controlled scheme-relative references for host-policy or routing decisions.The vulnerable
resolve()/equal()host-confusion path is not exercised by any application code path in these repos.Decision
Reachability is not established — the package is present only in build-time schema tooling with no untrusted-input host-policy usage. Per decision logic, an unreachable path is not_affected regardless of an available fix. Recommend suppressing this finding (repo-root
.trivyignore). If a future service adopts fastify or begins using fast-uri/ajv for URL/host validation on untrusted input, re-evaluate; bumping the override pin to 3.1.6 is a low-risk cleanup but is not required for security.CVE-2026-75975 — HIGH,
fast-uriThe CVE is an SSRF / address-policy-bypass primitive: fast-uri's IPv6 bracket parser silently rewrites malformed literals (e.g. [::not-valid] -> [::]) to valid loopback/private addresses with no error set, so an app that normalizes an UNTRUSTED URL before an outbound request, redirect, proxy route, or host-policy check can be steered to a local/private target. Reachability therefore hinges on whether any UID2 code feeds attacker-controlled URLs through fast-uri's normalize/parse. In all five flagged repos fast-uri is present only as a transitive dependency of ajv (the JSON Schema validator), which uses fast-uri internally to resolve schema $id/$ref URIs — trusted, developer-authored schema identifiers, not network destinations. Grep across every .js/.ts/.tsx/.jsx/.mjs/.cjs source file finds zero direct imports of fast-uri and no direct ajv usage against untrusted URLs; the package is pinned solely via a package.json "overrides" entry (^3.1.4) to force-resolve the transitive copy. The consumers are Docusaurus documentation sites (EUID-docs, uid2docs, uid2-docs-preview), client-side React example apps (uid2-examples), and the self-serve portal where ajv appears under build tooling (webpack, schema-utils, eslint, workbox) plus the objection ORM's data validation. None of these normalize untrusted URLs before outbound requests, so the vulnerable IPv6-normalization path is not reachable. Verdict rests on direct evidence (lockfile parent chains, absence of source imports); the only inference is that ajv's schema-URI usage never carries attacker-controlled hosts, which is standard ajv behaviour.
Full triage report — CVE-2026-75975
CVE-2026-75975 — fast-uri SSRF via malformed IPv6 normalization
Severity: HIGH (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) — GHSA-f65p-4m7j-42xc
Package: fast-uri, installed 3.1.4
Fixed in: 2.4.5, 3.1.6, 4.1.3
What the vulnerability is
fast-uridoes not validate the complete RFC 3986 grammar for bracketed IPv6 literals. A malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address, with no error reported on the parsed result. For examplenormalize('http://[::not-valid]/private')returnshttp://[::]/private, and[fc00::not-hex]/[fe80::not-hex]collapse to[fc00::]/[fe80::]. An application that normalizes an untrusted URL before an outbound request, redirect, proxy-routing decision, or host-policy/allowlist check can be redirected to loopback (::1), unique-local, or link-local addresses — a server-side request forgery and address-policy-bypass primitive. Becauseparse().errorstays unset, consumers checking the error field cannot detect the rewrite.How it appears in our repos
All five flagged repos carry
fast-uri@3.1.4only as a transitive dependency ofajv(the JSON Schema validator), which uses fast-uri internally to parse schema$id/$refURIs. Evidence:ajv-formats/node_modules/ajvandschema-utils/node_modules/ajvin the lockfiles. ajv here is invoked by webpack/schema-utils at build time.objectionORM's data validation.Each repo pins the version via a
package.json"overrides": { "fast-uri": "^3.1.4" }entry — a resolution pin, not a direct usage. A grep across all.js/.ts/.tsx/.jsx/.mjs/.cjssource files found no direct import offast-uriand no direct application code passing untrusted URLs through ajv or fast-uri.Reachability decision
The exploit requires normalizing an attacker-controlled URL through fast-uri before an outbound request or host-policy check. Our only consumer is ajv resolving trusted, developer-authored JSON Schema identifiers — never attacker-supplied network hosts. There is no code path in any of the five repos that feeds untrusted URLs into fast-uri's
normalize/parse. The vulnerable IPv6-normalization path is therefore not reachable.Verdict: not_affected — suppress. Upgrading fast-uri to 3.1.6 (or bumping ajv) is harmless housekeeping and can ride along with normal dependency maintenance, but it is not security-required here since the SSRF path is unreachable. Suppression belongs in each repo's root
.trivyignore.CVE-2026-76172 — HIGH,
fast-uriThe CVE is a URI-parsing flaw in fast-uri whereby percent-encoded characters in the scheme component are decoded with legacy unescape() and re-serialized verbatim, so an input like %2f%2fevil.example:/pwn parses with no authority but resolve()/normalize() emit //evil.example:/pwn — enabling host-confusion SSRF, off-site redirects, address-policy bypass, and CRLF injection. Exploitation requires an application that normalizes or resolves untrusted, attacker-controlled URLs before a redirect check, host allowlist, or outbound request. In all five flagged repos fast-uri@3.1.4 is present strictly as a transitive dependency of ajv (JSON Schema validator); no source file imports fast-uri or ajv directly (grep across all TS/JS returned nothing). ajv invokes fast-uri only to parse the $id/$ref URIs of developer-authored JSON schemas at build/validation time — never untrusted input steered into a network or redirect decision. The docs repos (uid2docs, EUID-docs, uid2-docs-preview) are Docusaurus static-site generators where ajv is build-tooling; uid2-examples ships demo React apps whose express servers only serve the static build; the portal's ajv comes from webpack/react-scripts build tooling and the objection ORM validating fixed model schemas. The vulnerable resolve()/normalize()-on-untrusted-URL path is therefore unreachable in every repo, so the finding is not exploitable despite the package being present and a fix being available.
Full triage report — CVE-2026-76172
CVE-2026-76172 — fast-uri host confusion via percent-encoded scheme normalization
Summary
fast-uri(a URI parser for Node.js) decodes percent-encoded characters in the URI scheme component using the legacy globalunescape()and serializes the result back as raw characters without re-escaping or validating it as a scheme. An input whose scheme carries percent-encoded slashes (e.g.%2f%2fevil.example:/pwn, or the%uXXXXform) parses with no authority (parse().hostisundefined), yetresolve()/normalize()emit//evil.example:/pwn, which re-parses to hostevil.example. Control characters such as%0d%0acan reach the output as raw CR/LF.AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N(integrity impact; SSRF / off-site redirect / address-policy bypass / header CRLF injection)Attack vector (per advisory)
Exploitation requires an application that normalizes or resolves untrusted, attacker-controlled URLs before a redirect check, host allowlist, or outbound-request decision — especially one treating a missing authority as same-origin. The flaw lets an attacker introduce authority structure the checked input did not appear to contain.
Reachability analysis
fast-uri@3.1.4was flagged in five repos. In every one it is present only transitively, as a dependency ofajv(JSON Schema validator):ajv-formats/ajvandschema-utils/ajv, i.e. build tooling. ajv runs at build time.server.jsonly serves the static build (requires fs/path/express); no URL resolution of untrusted input.fast-uri@3.1.4plus ~13 ajv copies from webpack, react-scripts, css/terser/mini-css plugins, eslint, babel-loader, and theobjectionORM. ajv validates developer-defined model schemas.A grep of all source files (
*.ts/js/tsx/jsx, excluding node_modules) found no direct import offast-uriorajvin any repo. ajv invokes fast-uri solely to parse the$id/$refURIs of developer-authored JSON schemas — not attacker-controlled URLs steered into a redirect, allowlist, or outbound-request decision. The specific vulnerable path (resolve()/normalize()over untrusted input feeding a security decision) is not exercised anywhere.Decision
not_affected. The package is present (confirmed by the scanner and lockfiles) but the vulnerable code path is unreachable in all five repos: fast-uri is reached only through ajv's build-time / schema-validation JSON
$refparsing, never through application handling of untrusted URLs. Per decision logic, an available fix does not change a not-exploitable verdict.Recommended action
Suppress this finding for all five repos (single repo-root
.trivyignoreper repo). A version bump to a patched fast-uri (≥3.1.6 in the 3.x line) is harmless and can be picked up naturally via ajv updates, but is not required to remediate exploitable risk here.Opened by uid2-vul-scan-agent (general_use_claude-opus-4-8) for the automated finding(s) above. Verdict confidence: high. Please sanity-check each reachability argument before approving.