Answer in brief
CVE-2026-84394 records a High severity (CVSS 7.5) vulnerability in fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority. The current sources do not mark it as known exploited. The current feed maps fast-uri/fast-uri (generic), fast-uri (npm), fast-uri (npm), fast-uri (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps fast-uri/fast-uri (generic), fast-uri (npm), fast-uri (npm), fast-uri (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:openjsf:fast-uri:2.4.5:*:*:*:*:node.js:*:* | Not reported | Not reported |
| cpe:2.3:a:openjsf:fast-uri:3.1.6:*:*:*:*:node.js:*:* | Not reported | Not reported |
| cpe:2.3:a:openjsf:fast-uri:4.1.3:*:*:*:*:node.js:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| fast-uri/fast-urigeneric | >=2.4.5 <2.4.6 || >=3.1.6 <3.1.7 || >=4.1.3 <4.1.4 | 2.4.6, 3.1.7, 4.1.4 |
| fast-urinpm | =2.4.5 | 2.4.6 |
| fast-urinpm | =3.1.6 | 3.1.7 |
| fast-urinpm | =4.1.3 | 4.1.4 |
| fast-urinpm | >=2.4.5 <2.4.6 | 2.4.6 |
| fast-urinpm | >=3.1.6 <3.1.7 | 3.1.7 |
| fast-urinpm | >=4.1.3 <4.1.4 | 4.1.4 |
Published upstream
Sep 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 2, 2026
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.
Quoted source text, attributed separately from HOL analysis.