Security vulnerabilities and automated fixes for unicode normalization issues
5 posts found
The `sanitizeUnicodeInput()` helper used by the project character-range settings screen rewrote `U+` prefixes to `0x` and called `parseInt()`, but never normalized its argument first. Compatibility-equivalent forms such as fullwidth `Ｕ＋`, superscript digits, or mathematical alphanumerics never matched the `/U\+/gi` regex, fell through to the `else return inputString` branch, and were handed back to callers verbatim as "sanitized" values. The fix inserts a `String.prototype.normalize('NFKC')` pas
A dependency tree in this repository resolved `fast-uri` 3.1.2, a version affected by CVE-2026-13676, in which improper Unicode hostname canonicalization lets a crafted URI parse to one host while the HTTP client connects to another. Because `fast-uri` is what `ajv` uses to parse and resolve URIs for `format: "uri"` validation and `$ref` resolution, any host allowlist built on its parsed output could be bypassed. The fix upgrades the resolved copy to `fast-uri` 4.1.4 and pins it with an npm `ove
CVE-2026-56852 is a high-severity denial-of-service vulnerability in `golang.org/x/text` where a `norm.Iter` iterator can enter an infinite loop when processing specially crafted Unicode input, hanging the process indefinitely. The `fe-tool` module was pinned to `v0.27.0`, which contains the flaw, and was upgraded to `v0.39.0` to eliminate the risk. Because `fe-tool` handles file-format parsing (7-Zip archives and Electron ASAR bundles), any user-supplied filename or archive content could have t
CVE-2026-56852 is a high-severity Denial of Service vulnerability in `golang.org/x/text` where `norm.Iter` can enter an infinite loop when processing invalid UTF-8 input, potentially hanging any Go application that normalizes untrusted text. The fix upgrades `golang.org/x/text` from v0.34.0 to v0.39.0 in `parser/go.mod`, closing the loop condition that malformed byte sequences could exploit. Developers using any version of `golang.org/x/text` below 0.39.0 should upgrade immediately.
CVE-2026-73420 is a critical authentication bypass vulnerability in Auth.js (next-auth) where the email normalizer validates an address before applying Unicode normalization, allowing an attacker to craft an email containing a Unicode homoglyph that looks like "@" to slip past validation and impersonate another user. The fix upgrades next-auth from 4.24.13 to 4.24.15 (and 5.0.0-beta.32 for the beta line), ensuring normalization happens before validation so lookalike characters are resolved to th