{"id":"CVE-2026-84394","sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","published":"2026-09-03T05:16:38.680","lastModified":"2026-09-04T16:12:20.970","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal."}],"affected":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","affectedData":[{"vendor":"fast-uri","product":"fast-uri","defaultStatus":"unaffected","packageURL":"pkg:npm/fast-uri","versions":[{"version":"2.4.5","lessThan":"2.4.6","versionType":"semver","status":"affected"},{"version":"2.4.6","versionType":"semver","status":"unaffected"},{"version":"3.1.6","lessThan":"3.1.7","versionType":"semver","status":"affected"},{"version":"3.1.7","versionType":"semver","status":"unaffected"},{"version":"4.1.3","lessThan":"4.1.4","versionType":"semver","status":"affected"},{"version":"4.1.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-03T13:14:34.742806Z","id":"CVE-2026-84394","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","description":[{"lang":"en","value":"CWE-436"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openjsf:fast-uri:2.4.5:*:*:*:*:node.js:*:*","matchCriteriaId":"7E247A05-D85A-432A-B9AD-5E109BBBA126"},{"vulnerable":true,"criteria":"cpe:2.3:a:openjsf:fast-uri:3.1.6:*:*:*:*:node.js:*:*","matchCriteriaId":"244CB511-E707-46C2-86CA-EB9F166EDF2E"},{"vulnerable":true,"criteria":"cpe:2.3:a:openjsf:fast-uri:4.1.3:*:*:*:*:node.js:*:*","matchCriteriaId":"9B9E720F-653C-4B03-BB56-65B68F0253B6"}]}]}],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","source":"ce714d77-add3-4f53-aff5-83d477b104bb","tags":["Vendor Advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g","source":"ce714d77-add3-4f53-aff5-83d477b104bb","tags":["Mitigation","Vendor Advisory"]}]}