Description
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-ajv | 6.12.4-1 | — |
| Debian 13 | node-ajv | 6.12.4-1 | — |
| Debian 12 | node-ajv | 6.12.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-ajv | No fix yet | — |
| Ubuntu 18.04 LTS | node-ajv | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nodejs +3 | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 | RHSA-2021:0551, RHSA-2021:0548, RHSA-2020:5499 |
| RHEL 8 | nodejs-nodemon | 1.18.3-1.module+el8.1.0+3369+37ae6a45 | RHSA-2021:0551, RHSA-2021:0548, RHSA-2020:5499 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHSA-2021:0551, RHSA-2021:0548, RHSA-2020:5499 |
| RHEL 8 | npm | 1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0 | RHSA-2021:0551, RHSA-2021:0548, RHSA-2020:5499 |
| RHEL 3 | rh-nodejs10-nodejs +2 | 10.23.1-2.el7 | RHSA-2021:0521 |
| RHEL 3 | rh-nodejs10-npm | 6.14.10-10.23.1.2.el7 | RHSA-2021:0521 |
| RHEL 3 | rh-nodejs12-nodejs +2 | 12.19.1-2.el7 | RHSA-2020:5305 |
| RHEL 3 | rh-nodejs12-npm | 6.14.8-12.19.1.2.el7 | RHSA-2020:5305 |
| RHEL 3 | rh-nodejs14-nodejs +2 | 14.15.4-2.el7 | RHSA-2021:0421 |
| RHEL 3 | rh-nodejs14-npm | 6.14.10-14.15.4.2.el7 | RHSA-2021:0421 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform 4 | automation-hub +2 | 4.2.2-1.el7pc | RHSA-2021:0781 |
| Red Hat Ansible Automation Platform 4 | python-bleach +1 | 3.3.0-1.el7pc | RHSA-2021:0781 |
| Red Hat Ansible Automation Platform 4 | python-bleach-allowlist +1 | 1.0.3-1.el7pc | RHSA-2021:0781 |
| Red Hat Ansible Automation Platform 4 | python-galaxy-importer +1 | 0.2.15-1.el7pc | RHSA-2021:0781 |
| Red Hat Ansible Automation Platform 4 | python-pulp-ansible +1 | 1:0.5.6-1.el7pc | RHSA-2021:0781 |
| Red Hat Ansible Automation Platform 4 | python3-django | 2.2.18-1.el7pc | RHSA-2021:0781 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2021:0551, ALSA-2021:0548, ALSA-2020:5499 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2021:0551, ALSA-2021:0548, ALSA-2020:5499 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2021:0551, RLSA-2021:0548, RLSA-2020:5499 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2021:0551, RLSA-2021:0548, RLSA-2020:5499 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nodejs +3 | 1:10.23.1-1.module+el8.3.0+9642+87902f83 | ELSA-2021-0551, ELSA-2021-0548, ELSA-2020-5499 |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.1.0+5392+4d6b561f | ELSA-2021-0551, ELSA-2021-0548, ELSA-2020-5499 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.1.0+5392+4d6b561f | ELSA-2021-0551, ELSA-2021-0548, ELSA-2020-5499 |
| Oracle Linux 8 | npm | 1:6.14.8-1.12.19.1.1.module+el8.3.0+7884+668e4ef8 | ELSA-2021-0551, ELSA-2021-0548, ELSA-2020-5499 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ajv | < 6.12.3 | 6.12.3 | GHSA-v88g-cgmw-v5xw |
Advisories 18
- ALSA-2020:5499 Moderate: nodejs:12 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2021:0551 Moderate: nodejs:14 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2021:0548 Moderate: nodejs:10 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-4026 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2021:0521 Red Hat Security Advisory: rh-nodejs10-nodejs security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:0548 Red Hat Security Advisory: nodejs:10 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:0551 Red Hat Security Advisory: nodejs:14 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0421 Red Hat Security Advisory: rh-nodejs14-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:5499 Red Hat Security Advisory: nodejs:12 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:5305 Red Hat Security Advisory: rh-nodejs12-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0781 Red Hat Security Advisory: Red Hat Ansible Automation Platform 1.2.2 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RLSA-2021:0551 Moderate: nodejs:14 security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2021:0548 Moderate: nodejs:10 security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2020:5499 Moderate: nodejs:12 security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- ELSA-2021-0548 Moderate: nodejs:10 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 20, 2021
- ELSA-2021-0551 Moderate: nodejs:14 security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 20, 2021
- ELSA-2020-5499 Moderate: nodejs:12 security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 17, 2020