fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-84394 · Microsoft / collected KEV context

EUVD-2026-70282

GHSA-58mr-gqgx-xq4g

cve-program · CVE-2026-84394

• https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-70282

• https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-84394

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g

osv · GHSA-58mr-gqgx-xq4g

• https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g
• https://nvd.nist.gov/vuln/detail/CVE-2026-84394
• https://github.com/fastify/fast-uri/pull/214
• https://github.com/fastify/fast-uri/commit/e00815236bc94107e44ef1b2f5318a06bac225c0
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.6
• https://github.com/fastify/fast-uri/releases/tag/v3.1.7
• https://github.com/fastify/fast-uri/releases/tag/v4.1.4

• fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor cano… · Advisory content revised · 1 Nov 2026