Answer in brief
CVE-2026-84292 records a High severity (CVSS 7.5) vulnerability in fast-uri vulnerable to authority injection via an unvalidated port in serialize. The current sources do not mark it as known exploited. The current feed maps fast-uri/fast-uri (generic), fast-uri (npm), fast-uri (npm), fast-uri (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps fast-uri/fast-uri (generic), fast-uri (npm), fast-uri (npm), fast-uri (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| fast-uri/fast-urigeneric | >=0 <2.4.6 || >=3.0.0 <3.1.7 || >=4.0.0 <4.1.4 | 2.4.6, 3.1.7, 4.1.4 |
| fast-urinpm | <2.4.6 | 2.4.6 |
| fast-urinpm | >=3.0.0,<3.1.7 | 3.1.7 |
| fast-urinpm | >=4.0.0,<4.1.4 | 4.1.4 |
| fast-urinpm | >=0 <2.4.6 | 2.4.6 |
| fast-urinpm | >=3.0.0 <3.1.7 | 3.1.7 |
| fast-urinpm | >=4.0.0 <4.1.4 | 4.1.4 |
Published upstream
Sep 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 2, 2026
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.
Quoted source text, attributed separately from HOL analysis.