Node ajv: fast-uri serializes the port component of a URI without validating it. (CVE-2026-84292)

The vulnerability identified as CVE-2026-84292 affects the node-ajv package, specifically the fast-uri component that serializes the port component of a URI without proper validation. This can lead to integrity issues as indicated by the CVSS vector (no confidentiality or availability impact, but integrity impact is high). The issue is addressed in a security update for Red Hat Hardened Images RPMs, which includes fixes for multiple CVEs including CVE-2026-84292. The affected products include Red Hat Edge Manager, Red Hat OpenShift Container Platform, and Red Hat Satellite among others. The Red Hat advisory RHSA-2026:63782 confirms the availability of a patch for this vulnerability.

The vulnerability impacts the integrity of the affected software by allowing improper serialization of the URI port component, which could be exploited to cause incorrect behavior or data corruption. There is no direct impact on confidentiality or availability according to the CVSS vector. The vulnerability affects several Red Hat products that use the hardened images RPMs, potentially affecting systems running these products if unpatched.

A security update is available from Red Hat as detailed in advisory RHSA-2026:63782. Users of affected Red Hat Hardened Images RPMs should apply the update to remediate CVE-2026-84292 and related vulnerabilities. Follow the instructions provided by Red Hat at https://images.redhat.com/ for applying the update. No additional mitigation steps are specified beyond applying the official patch.