CVE-2026-84394: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.6 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.7 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.4
Event History
Frequently Asked Questions
Which applications are realistically exposed to exploitation?
Applications are exposed when they use fast-uri to make a host-based security or routing decision, then pass the original URL to a Node HTTP client or another consumer based on Node's URL handling. Examples include SSRF denylists, redirect allowlists, and proxy routing rules.
What does an attacker need to exploit this issue?
An attacker needs to supply a URL whose authority contains an unbalanced or misplaced bracket. The application must rely on fast-uri's parsed host for validation or authorization while sending the original URL onward for the actual request.
How can this be remediated?
Upgrade fast-uri to 2.4.6, 3.1.7, or 4.1.4, depending on the maintained release line. These versions report a malformed host when a host contains a bracket but is not a valid IPv6 literal.
What can be done if an upgrade cannot be applied immediately?
Reject input URLs with brackets in the authority unless the host is validated as a valid IPv6 literal before applying host-based policy. Do not make authorization, allowlist, denylist, or routing decisions from fast-uri's host value while passing an unvalidated original URL to an HTTP client.
How can I determine whether my deployment is affected?
Check whether the application uses fast-uri 2.4.5, 3.1.6, or 4.1.3 and uses parse(), normalize(), equal(), or resolve() on untrusted URLs in a host-sensitive workflow. Affected behavior is present when an authority host beginning with an opening bracket but lacking a closing bracket is returned by parse() with error undefined.