URI Serialization Vulnerability in Fast-URI by Fastify

CVE-2026-84292

What is CVE-2026-84292?

The fast-uri library is susceptible to a URI serialization vulnerability that arises from inadequate validation of the port component. This flaw allows an attacker to potentially inject authority delimiters into a URI. The vulnerability occurs when URI components are assembled using untrusted data, specifically when a non-digit sequence is passed as a port value. As a result, the authority of the URI can be manipulated to point to an attacker-controlled host, allowing for possible exploitation. Notably, appropriate fixes have been implemented in later versions, where the recomposeAuthority function ensures only valid digit sequences are accepted for the port component, adhering to RFC 3986.

References