{"schema":"threatline.record/2","record":{"id":"CVE-2026-84394","aliases":["GHSA-58mr-gqgx-xq4g"],"summary":"fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority","details":"### Impact\n\n`fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without reporting an error. A host that starts with `[` but does not end with `]`, such as `[@127.0.0.1`, is neither validated as an IP literal nor canonicalized as a domain name, so `parse()` returns it as the host with `error` undefined, while Node's `URL` (and `http.get`, `axios`, `got`, and other clients built on it) resolve the same string to `127.0.0.1`. An application that reads `parse().host` to make a host decision (an SSRF denylist, a redirect allowlist, or proxy routing) and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through `normalize()`, `equal()`, and `resolve()`.\n\n### Patches\n\nThis vulnerability has been patched in fast-uri `4.1.4`, `3.1.7`, and `2.4.6`. `parse()` now reports `URI host is malformed.` for any host that contains a bracket but is not a valid `[IPv6]` literal. All users should upgrade.\n\n### Workarounds\n\nIf upgrading is not immediately possible, reject any URL whose host contains a `[` or `]` that is not a well-formed IPv6 literal before making a host decision. Clients that fail closed on credential-bearing URLs, such as Node's global `fetch()`, are not affected by the reported vector.","categories":["Libraries & packages"],"product":"fast-uri","vendor":"fast-uri","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:23:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri"},"range":"= 2.4.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:23:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri"},"range":"= 3.1.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:23:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri"},"range":"= 4.1.3"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84394","source_modified_at":"2026-09-03T13:14:42.123Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"fast-uri","vendor":"fast-uri","versions":[{"versionType":"semver","status":"affected","version":"2.4.5","lessThan":"2.4.6"},{"versionType":"semver","status":"unaffected","version":"2.4.6"},{"versionType":"semver","status":"affected","version":"3.1.6","lessThan":"3.1.7"},{"versionType":"semver","status":"unaffected","version":"3.1.7"},{"versionType":"semver","status":"affected","version":"4.1.3","lessThan":"4.1.4"},{"versionType":"semver","status":"unaffected","version":"4.1.4"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:30:05.360758321Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri","purl":"pkg:npm/fast-uri"},"ranges":[{"events":[{"introduced":"2.4.5"},{"fixed":"2.4.6"}],"type":"SEMVER"}],"versions":["2.4.5"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:30:05.360758321Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri","purl":"pkg:npm/fast-uri"},"ranges":[{"events":[{"introduced":"3.1.6"},{"fixed":"3.1.7"}],"type":"SEMVER"}],"versions":["3.1.6"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:30:05.360758321Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri","purl":"pkg:npm/fast-uri"},"ranges":[{"events":[{"introduced":"4.1.3"},{"fixed":"4.1.4"}],"type":"SEMVER"}],"versions":["4.1.3"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:23:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri"},"version":"2.4.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:23:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri"},"version":"3.1.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:23:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri"},"version":"4.1.4"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84394","source_modified_at":"2026-09-03T13:14:42.123Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fast-uri","ecosystem":null},"version":"2.4.6","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84394","source_modified_at":"2026-09-03T13:14:42.123Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fast-uri","ecosystem":null},"version":"3.1.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84394","source_modified_at":"2026-09-03T13:14:42.123Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fast-uri","ecosystem":null},"version":"4.1.4","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:30:05.360758321Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri","purl":"pkg:npm/fast-uri"},"version":"2.4.6"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:30:05.360758321Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri","purl":"pkg:npm/fast-uri"},"version":"3.1.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-58mr-gqgx-xq4g","source_modified_at":"2026-09-28T21:30:05.360758321Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-uri","purl":"pkg:npm/fast-uri"},"version":"4.1.4"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0038,"percentile":0.3079,"score_date":"2026-10-23"},"published_at":"2026-09-02T20:25:35.399Z","modified_at":"2026-09-28T21:30:05.360758321Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-58mr-gqgx-xq4g","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-28T21:23:36Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-84394","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-03T13:14:42.123Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-58mr-gqgx-xq4g","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-28T21:30:05.360758321Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84394","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84394","source":"GitHub Advisory Database"},{"url":"https://github.com/fastify/fast-uri/pull/214","source":"GitHub Advisory Database"},{"url":"https://github.com/fastify/fast-uri/commit/e00815236bc94107e44ef1b2f5318a06bac225c0","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.6","source":"GitHub Advisory Database"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.7","source":"GitHub Advisory Database"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.4","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-58mr-gqgx-xq4g","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-03T13:14:34.742806Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-28T21:30:05.360758321Z","content_hash":"1fde65bfc5d48998c425af1cc92b081a3661ffa31488df7c685a3f2d6d739cdc"}}