EUVD-2026-70280
GHSA-qw65-cvwx-89v3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding for downstream
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the intended host to userinfo and redirect the parsed authority to an attacker-controlled hostname, bypassing downstream re-validation because both fast-uri and Node.js's built-in URL parser silently accept the malformed output as well-formed. Applications in the Fastify ecosystem that build URIs from parts — passing untrusted data into the port field of a URI object through serialize, normalize, or equal — on fast-uri versions before 2.4.6, 3.1.7, or 4.1.4 are affected. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV; vendor-released patches are available across all three active release lines.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Fast Uri gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb
Lifecycle Timeline
2DescriptionCVE.org
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.
Technical POC Analysis
Flaw class: CWE-116, Improper Encoding or Escaping of Output.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The fast-uri package used by Fastify applications contains an authority injection vulnerability (CVE-2026-84292, CVSS 7.5) that allows attackers to bypass host validation by injecting delimiter characters into the port field, potentially redirecting traffic to attacker-controlled servers. Any Fastify-based application that constructs URIs from untrusted data without additional validation is exposed to host spoofing and potential man-in-the-middle attacks. Immediate patching is required to eliminate this integrity risk.
Within 24 hours, identify all Fastify applications in your environment and review package.json dependencies for fast-uri versions before 2.4.6, 3.1.7, or 4.1.4. Within 7 days, upgrade all affected applications to the patched versions: fast-uri 2.4.6 (for v2.x users), 3.1.7 (for v3.x users), or 4.1.4 (for v4.x users); redeploy after testing in non-production. Within 30 days, audit Fastify application code to identify any patterns where user-supplied or untrusted port values are passed directly to URI construction methods (serialize, normalize, equal), and implement input validation as a defense-in-depth control to reject malformed port values before URI processing.
Vendor-released patch: 2.4.6 (v2 line), 3.1.7 (v3 line), 4.1.4 (v4 line). Until patched, validate and sanitize all untrusted data before passing to fast-uri port fields; reject port values containing non-numeric characters or delimiters, and restrict port input to the range 0-65535.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify eco
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and
Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remot
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to
Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls
Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T
Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy ro
Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the res
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
Exploit-DB