CVE-2026-84394
Received Received - Intake

URI Parsing Discrepancy in fast-uri Library

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: openjs

Description
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-84394

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
openjs_foundation on-headers *
fastify fast-uri 2.4.5
fastify fast-uri 3.1.6
fastify fast-uri 4.1.3
fastify fast-uri From 2.4.6 (inc)
fastify fast-uri From 3.1.7 (inc)
fastify fast-uri From 4.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves fast-uri incorrectly handling hosts with unbalanced brackets in URIs. When a host starts with an opening bracket but lacks a closing bracket, fast-uri's parse() function returns the malformed string as the host without error. Meanwhile, Node.js's URL and HTTP clients resolve the same string to a different host. This discrepancy can cause applications to make incorrect security decisions based on the parsed host.

Detection Guidance

To detect this vulnerability, inspect applications using fast-uri versions 2.4.5, 3.1.6, or 4.1.3. Check for URLs with unbalanced brackets in hosts (e.g., [@127.0.0.1). Use commands like 'npm list fast-uri' to verify installed versions. Test parsing behavior with malformed URIs to observe inconsistencies between fast-uri and Node.js URL resolution.

Impact Analysis

This vulnerability can impact applications that rely on fast-uri's parse() function for security decisions, such as SSRF denylists, redirect allowlists, or proxy routing. If an application uses the parsed host to enforce policies but passes the original URL to an HTTP client, the actual host of the request may differ from the parsed one, potentially bypassing security controls.

Compliance Impact

This vulnerability could lead to security policy bypasses, such as incorrect host validation in SSRF denylists or redirect allowlists. If exploited, it may allow unauthorized access to internal systems or data, potentially violating GDPR's data protection requirements or HIPAA's access controls.

Mitigation Strategies

Upgrade fast-uri to patched versions (2.4.6, 3.1.7, or 4.1.4) immediately. As a temporary workaround, reject URLs with unbalanced brackets that aren't valid IPv6 literals before processing. Ensure applications using fast-uri validate hosts consistently with Node.js URL behavior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart