CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize
Attackers can inject authority delimiters via unvalidated port values in fast-uri, redirecting requests to attacker-controlled hosts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84292?
CVE-2026-84292 is a high-severity vulnerability in fast-uri, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.
Weakness: CWE-116
Which versions are affected by CVE-2026-84292?
6 open source packages ship an affected version, including fast-uri. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fast-uri npm | All versions | 2.4.6 |
fast-uri npm | All versions | 2.4.6 |
fast-uri npm | From 3.0.0 | 3.1.7 |
fast-uri npm | From 3.0.0 | 3.1.7 |
fast-uri npm | From 4.0.0 | 4.1.4 |
fast-uri npm | From 4.0.0 | 4.1.4 |
Products include Openjsf Fast-Uri.
How do I fix CVE-2026-84292?
Upgrade fast-uri to a fixed version for your release line: 2.4.6, 3.1.7 or 4.1.4.
Is CVE-2026-84292 being exploited?
There is no known exploitation of CVE-2026-84292 in the wild and no public exploit code.
Other vulnerabilities in fast-uri
- CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
- CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
- CVE-2026-75931 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
- CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Sources
Also known as CLEANSTART-2026-CC59685, CLEANSTART-2026-QL19617, CLEANSTART-2026-RF54758, CLSA-2026-1790759588, CLSA-2026-1791833496, CLSA-2026-1791833719 and 41 more.