CVE-2026-84292

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.6 fast-uri versions 3.0.0 through 3.1.6 fast-uri versions 4.0.0 through 4.1.3

Description The software serializes the port component of a URI without proper validation. During the recomposition of the authority, the port is concatenated verbatim while the userinfo and host components are escaped. This allows a port value containing non-digit characters to inject authority delimiters, which can demote the intended host to userinfo and redirect the authority to an attacker-controlled host. This issue occurs in applications that construct URIs from parts and assign untrusted data to the port component using the serialize, normalize, or equal functions in their object forms.

Recommendations Update to version 2.4.6. Update to version 3.1.7. Update to version 4.1.4.