CVE-2026-84292 fast-uri CVE debrief

Who should care

Developers and administrators using fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4 should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The fast-uri library has a vulnerability where the port component of a URI is not validated during serialization. When recomposing the authority, the userinfo and host components are escaped, but the port is concatenated verbatim. This allows a port value that is not a sequence of digits to inject authority delimiters, effectively demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms.

Defensive priority

High priority due to potential for security issues through injection of attacker-controlled hosts.

Recommended defensive actions

• Update fast-uri to version 2.4.6, 3.1.7, or 4.1.4, or later
• Validate user input for port components in URIs
• Monitor for potential security issues related to URI injection
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability exists due to improper validation of the port component in fast-uri. Affected versions include those before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. Fixes are available in versions 2.4.6, 3.1.7, and 4.1.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.