CVE-2026-84394

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.6 fast-uri versions prior to 3.1.7 fast-uri versions prior to 4.1.4

Description The parse() function fails to report an error when a host contains an unbalanced or misplaced authority bracket. A host starting with an opening bracket but lacking a closing bracket is not validated as an IP literal or canonicalized as a domain name. Consequently, the function returns the host with an undefined error, whereas Node's URL and associated HTTP clients resolve the string to a different host. This discrepancy can lead to host confusion in applications using the parsed host for security decisions, such as SSRF denylists, redirect allowlists, or proxy routing, as the policy is evaluated against a string different from the actual destination host. This behavior also persists through the normalize, equal, and resolve functions.

Recommendations Update to version 2.4.6 or later. Update to version 3.1.7 or later. Update to version 4.1.4 or later.