1 vulnerability across 1 product scored HIGH or above on September 03, 2026.

  • 🟠 HIGH: 1

🟠 [HIGH] fast-uri/fast-uri

1 CVE | CVSS 3.1: 7.5 | AAS 9.6

  • cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:*

fast-uri — Host Parsing Discrepancy Enables SSRF (HIGH)

A high-severity vulnerability (CVE-2026-84394, CVSS 7.5) affects fast-uri, a popular URI parsing library widely used in the Node.js ecosystem. The flaw stems from improper handling of unbalanced authority brackets in hostnames: fast-uri silently accepts malformed hosts without error, returning a parsed hostname that differs from what Node’s built-in URL parser and downstream HTTP clients resolve. This discrepancy allows attackers to bypass host-based security checks, enabling server-side request forgery (SSRF) in applications that rely on fast-uri’s parsed output for access control or routing decisions. The vulnerability is considered exploitable. Teams using fast-uri directly or as a transitive dependency — particularly in server-side rendering frameworks, API gateways, or any application performing host validation before making outbound requests — should review the vendor advisory at the OpenJS Foundation security page and upgrade to a patched version immediately.

Vendor Advisory