EUVD-2026-70282
GHSA-58mr-gqgx-xq4g
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy routing rules by submitting URLs containing unbalanced authority brackets. Affected versions 2.4.5, 3.1.6, and 4.1.3 of the Fastify ecosystem URI parsing library return the malformed bracket-containing string as the host without raising an error, while Node.js's URL implementation and downstream HTTP clients resolve the same string to an entirely different host. Any application that reads the fast-uri-parsed host to enforce a security policy, then passes the original URL to an HTTP client, evaluates its controls against a string that is never the host the request actually reaches.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Fast Uri gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.
Technical POC Analysis
Bug class: CWE-436, interpretation conflict.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Organizations using Fastify web services with fast-uri library versions 2.4.5, 3.1.6, or 4.1.3 face a critical SSRF vulnerability that renders existing security controls ineffective. Attackers can exploit this parsing ambiguity to bypass protective allowlists and denylists, potentially gaining unauthorized access to internal systems and data without triggering security monitoring.
Within 24 hours, enumerate all applications using affected fast-uri versions (2.4.5, 3.1.6, 4.1.3) and classify by business criticality. Within 7 days, implement network-layer mitigations including egress filtering to restrict HTTP client access from affected applications to explicitly approved internal IP ranges and ports only. Simultaneously, deploy WAF rules to detect and block URLs containing unbalanced brackets in the authority section. Within 30 days, continuously monitor vendor advisories for patch releases; evaluate alternative URI parsing libraries for compatibility; and plan a phased migration schedule to patched versions as they become available, prioritizing production systems with external-facing components.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation restricting egress from affected applications to explicitly whitelisted internal IP addresses and ports, Web Application Firewall rules to detect unbalanced brackets in URL authority sections, application-level URL validation using an alternative URI parser, and enhanced monitoring of outbound HTTP connections from affected services for anomalous destination access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify eco
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and
Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remot
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ
URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to
Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls
Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T
Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the res
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects
Same weakness CWE-436 – Interpretation Conflict
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
Exploit-DB