Improper Input Validation in fast-uri Affects Multiple Versions
CVE-2026-84394

7.5HIGH

Key Information:

Vendor

Fast-uri

Status
Fast-uri
Vendor
CVE Published:
2 September 2026

What is CVE-2026-84394?

The fast-uri library processes hosts with unbalanced or misplaced authority brackets without generating an error, leading to incorrect host parsing. This vulnerability allows an attacker to exploit the difference in resolution between Node's URL and HTTP clients, potentially bypassing security policies such as SSRF denylists or redirect allowlists. As a result, applications may unintentionally route requests to a different host than intended, compromising application security. The issue affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, with remediation available in versions 2.4.6, 3.1.7, and 4.1.4, where the parse function correctly identifies malformed hosts that include brackets.

Affected Version(s)

fast-uri 2.4.5 < 2.4.6

fast-uri 3.1.6 < 3.1.7

fast-uri 4.1.3 < 4.1.4

References

https://github.com/fastify/fast-uri/security/advisories/G...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

YashvantHange
mcollina
UlisesGascon
.