CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
An attacker can bypass SSRF protections or redirect allowlists by exploiting host confusion in fast-uri, causing policy checks to evaluate a different host than the one actually requested.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84394?
CVE-2026-84394 is a high-severity server-side request forgery vulnerability in fast-uri, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.
Weakness: CWE-436
Which versions are affected by CVE-2026-84394?
6 open source packages ship an affected version, including fast-uri. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fast-uri npm | From 2.4.5 | 2.4.6 |
fast-uri npm | From 2.4.5 | 2.4.6 |
fast-uri npm | From 3.1.6 | 3.1.7 |
fast-uri npm | From 3.1.6 | 3.1.7 |
fast-uri npm | From 4.1.3 | 4.1.4 |
fast-uri npm | From 4.1.3 | 4.1.4 |
Products include Openjsf Fast-Uri.
How do I fix CVE-2026-84394?
Upgrade fast-uri to a fixed version for your release line: 2.4.6, 3.1.7 or 4.1.4.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-84394 being exploited?
There is no known exploitation of CVE-2026-84394 in the wild and no public exploit code.
Other vulnerabilities in fast-uri
- CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize
- CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
- CVE-2026-75931 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
- CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Sources
Also known as DEBIAN-CVE-2026-84394, GHSA-58mr-gqgx-xq4g, MINI-4m8g-93c4-xcj4, MINI-7pfm-r9px-5979, MINI-83f6-7vxm-4gcg, MINI-96v9-g3j8-rjcp and 7 more.