SB2026090297 - Multiple vulnerabilities in fast-uri

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-84292)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to redirect URI authority to an attacker-controlled host.

The vulnerability exists due to improper encoding or escaping of output in the authority recomposition logic when serializing a URI with an unvalidated port component. A remote attacker can supply a non-digit port value containing authority delimiters to redirect URI authority to an attacker-controlled host.

The issue is reachable through the object forms of serialize(), normalize(), and equal(). A port value obtained from parse() is always digits and is not affected.

2) Interpretation Conflict (CVE-ID: CVE-2026-84394)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass host-based security decisions.

The vulnerability exists due to interpretation conflict in URI authority host parsing when processing a URL containing an unclosed or misplaced bracket in the authority. A remote attacker can supply a specially crafted URL to bypass host-based security decisions.

This issue can occur when an application evaluates policy using the parsed host value and then sends the original URL through an HTTP client that resolves the host differently.

Remediation

Install update from vendor's website.

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3
• https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g