CVE-2026-84394 in fast-uri
Summary
by MITRE • 09/02/2026
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in the fast-uri library represents a critical parsing inconsistency between JavaScript URI handling implementations, specifically affecting versions 2.4.5 through 3.1.6 and version 4.1.3 of the package. This flaw centers on how the library processes hostnames that contain unbalanced or misplaced authority brackets, such as strings starting with an opening bracket but lacking a corresponding closing bracket. In standard URI syntax, square brackets are reserved for IPv6 address literals within URLs. When fast-uri encounters a malformed bracket sequence in the host component of a URL, it fails to validate this structure against established standards like RFC 3986 or RFC 5952. Instead of throwing an error or rejecting the input as invalid, the parser silently accepts the string and returns it as the host with an undefined error state. This behavior creates a significant divergence from Node.js's native URL implementation and other HTTP clients built upon it, which typically resolve such malformed inputs differently, often by stripping the brackets or treating them as part of the path rather than the authority section.
This discrepancy leads to severe operational impacts in security-critical applications that rely on host-based decision-making logic. For instance, many web applications implement Server-Side Request Forgery (SSRF) mitigations using denylists, redirect allowlists, or proxy routing configurations that inspect the parsed hostname before executing a request. Because fast-uri returns the original malformed string as the host without flagging it as an error, developers may inadvertently validate their security policies against this uncanonicalized input. However, when the actual HTTP client processes the same URL object, it resolves the host differently due to its own parsing logic. Consequently, the application evaluates its access control policy against a string that does not match the destination address of the outgoing request. This mismatch allows attackers to bypass security controls by crafting URLs with specific bracket placements that pass validation checks but result in requests being directed to unintended or internal targets.
The vulnerability is further exacerbated because the malformed host state persists through subsequent operations such as normalization, equality checking, and URL resolution within the library's ecosystem. An attacker can exploit this inconsistency to circumvent SSRF protections by embedding malicious IP addresses or internal domain names within bracketed structures that appear valid to the application’s validation layer but are interpreted differently by the underlying network stack. This aligns with CWE-20 Improper Input Validation, as the software fails to verify that inputs meet specified requirements before processing them. Additionally, it relates to CWE-749 Exposed Dangerous Method or API if the library is used in a context where untrusted URLs are processed without strict canonicalization, and potentially CWE-611 Information Exposure Through an Error Message if the undefined error state leads to unexpected behavior that aids reconnaissance. From an ATT&CK perspective, this flaw facilitates techniques associated with T1071 Application Layer Protocol for SSRF attacks or T1534 Internal Spearphishing if used in conjunction with other vectors to access internal resources.
To mitigate this risk, organizations using the affected versions of fast-uri must immediately upgrade to patched releases where version 2 is updated to at least 2.4.6, version 3 to at least 3.1.7, and version 4 to at least 4.1.4. These updates introduce stricter validation logic that reports a malformed host error for any input containing brackets that do not conform to valid IPv6 literal syntax. Until the upgrade is performed, developers should implement additional defensive coding practices by manually validating URL hosts against strict regex patterns or using alternative parsing libraries with more rigorous standards compliance before passing URLs to HTTP clients. It is also advisable to audit existing codebases for SSRF mitigation logic to ensure that host comparisons are performed on canonicalized values rather than raw parsed outputs from vulnerable library versions, thereby closing the gap between policy evaluation and actual network behavior.