Improper Encoding or Escaping of Output in fast-uri - CVE-2026-84292

Vulnerability details

The vulnerability allows a remote attacker to redirect URI authority to an attacker-controlled host.

The vulnerability exists due to improper encoding or escaping of output in the authority recomposition logic when serializing a URI with an unvalidated port component. A remote attacker can supply a non-digit port value containing authority delimiters to redirect URI authority to an attacker-controlled host.

The issue is reachable through the object forms of serialize(), normalize(), and equal(). A port value obtained from parse() is always digits and is not affected.

Affected software

How to mitigate CVE-2026-84292

External References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3

Related Security Bulletins

• Multiple vulnerabilities in fast-uri
• Red Hat Enterprise Linux 10 update for cockpit-image-builder
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM Db2 Developer Extension
• Multiple vulnerabilities in Automation Assets in IBM Integration