EUVD-2026-70280Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb
Lifecycle Timeline
4DescriptionCVE.org
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.
AnalysisAI
URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the intended host to userinfo and redirect the parsed authority to an attacker-controlled hostname, bypassing downstream re-validation because both fast-uri and Node.js's built-in URL parser silently accept the malformed output as well-formed. Applications in the Fastify ecosystem that build URIs from parts — passing untrusted data into the port field of a URI object through serialize, normalize, or equal — on fast-uri versions before 2.4.6, 3.1.7, or 4.1.4 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Recommended ActionAI
Within 24 hours, identify all Fastify applications in your environment and review package.json dependencies for fast-uri versions before 2.4.6, 3.1.7, or 4.1.4. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remot
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to
Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls
Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify eco
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ
Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy ro
Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today