VulnSocial

CVE-2026-84394Patch(openjsf / fast-uri)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch openjsf fast-uri systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.

openjsf CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-436

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fast-uri

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-09-02); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
openjsf
Products
fast-uri

3 versions affected across 1 product

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-02: 1Mentions · 2026-09-28: 1Mentions · 2026-09-30: 1Patch / Workaround · 2026-09-02: 1Patch / Workaround · 2026-09-30: 1Technical Details · 2026-09-02: 1Technical Details · 2026-09-28: 1Technical Details · 2026-09-30: 109-0209-2809-30
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-021
Patch1
2026-09-281
Disclosure1
2026-09-301
Patch1
Full discourse3 posts
  • DailyCVE@dailycve
    Disclosure

    🔴 fast-uri, Host Confusion via Unclosed Authority Bracket, #CVE-2026-84394 (High) -DC-Sep2026-2602 https://dailycve.com/fast-uri-host-confusion-via-unclosed-authority-bracket-cve-2026-84394-high-dc-sep2026-2602/

    Post summary

    The text announces a newly disclosed high-severity vulnerability in fast-uri related to Host header confusion via unclosed authority brackets, providing limited technical details without mentioning exploitation or remediation steps.

    0001055
    238 followersView on X
  • Ulises Gascón@kom_256
    Patch

    🚨 High-severity security fix in fast-uri (4.1.4, 3.1.7, 2.4.6) just released! Patches CVE-2026-84394: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g

    Post summary

    Fast‑uri CVE-2026-84394 has been fixed in recent releases, addressing a host confusion flaw caused by an unclosed bracket in the URI authority.

    00010213
    5.6K followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨HIGH - fast-uri Host Confusion via Malformed Authority Brackets (CVE-2026-84394) fast-uri parse() accepts bracket-containing non-IPv6 hosts (unbalanced/misplaced []) and returns a host that can differ from Node’s URL/HTTP resolution. If apps enforce SSRF denylists/allowlists/proxy routing on fast-uri’s parsed host but fetch the original URL, attackers can bypass policy and reach a different backend. Proper IPv6 literals are not affected. 👉Affected: fast-uri < 2.4.6, >= 3.0.0 < 3.1.7, >= 4.0.0 < 4.1.4 | Upgrade to 2.4.6 / 3.1.7 / 4.1.4

    Post summary

    The text details a high-severity host confusion vulnerability in the fast-uri library (CVE-2026-84394) that can bypass SSRF restrictions, while explicitly providing the affected versions and the required upgrades to remediate it.

    0000058
    311 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appopenjsffast-uri2.4.5node.js-
Appopenjsffast-uri3.1.6node.js-
Appopenjsffast-uri4.1.3node.js-

Explore more

Back to dashboardopenjsf CVEsfast-uri vulnerabilities