CVE-2026-84292: fast-uri vulnerable to authority injection via an unvalidated port in serialize
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.6 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.7 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.4
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are affected when they construct URI objects and place untrusted input in the port component while using fast-uri's object-form serialize, normalize, or equal functions. The impact is authority redirection: delimiter characters in the port can cause the intended host to become userinfo and the authority to resolve to an attacker-controlled host.
Can validating the URI after fast-uri builds it detect an attempted injection?
No. Both fast-uri and Node's URL parse the resulting URI as pointing to the attacker-controlled host without raising an error, so validation performed only after recomposition will not identify the malformed port input.
What versions contain the fix?
Upgrade to fast-uri 2.4.6, 3.1.7, or 4.1.4, as applicable to your major version. These releases reject port values that are not digit sequences.
What can be done before upgrading?
Validate port input before passing URI objects to serialize, normalize, or equal. Accept only a sequence of digits for the port component and reject any value containing URI delimiters or other non-digit characters.