CVE-2026-84292: fast-uri SSRF Vulnerability

CVE-2026-84292 Overview

CVE-2026-84292 is an output encoding flaw [CWE-116] in the fast-uri Node.js library. The library serializes the port component of a URI without validating that it contains only digits. When recomposeAuthority rebuilds the authority section, it escapes userinfo and host but concatenates the port verbatim. An attacker who controls the port value can inject authority delimiters, demoting the intended host to userinfo and redirecting the authority to an attacker-controlled host. Both fast-uri and Node's built-in URL parser accept the resulting string without error, so post-build re-validation fails to catch the manipulation.

Critical Impact
Applications that assign untrusted input to the port field of a URI object can be tricked into sending requests to attacker-controlled hosts, enabling server-side request forgery and integrity compromise of outbound traffic.

Affected Products

fast-uri versions before 2.4.6
fast-uri versions 3.0.0 through 3.1.6
fast-uri versions 4.0.0 through 4.1.3

Discovery Timeline

2026-09-02 - CVE-2026-84292 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84292

Vulnerability Analysis

The vulnerability resides in the recomposeAuthority function of fast-uri, which assembles the authority portion of a URI from a component object. The function correctly percent-encodes the userinfo and host fields but treats the port field as trusted text. When a caller passes a string containing authority delimiters such as @ or / in the port slot, those characters pass through unchanged into the serialized URI.

The resulting URI parses ambiguously. Because RFC 3986 authority parsing uses the last @ to separate userinfo from host, an attacker-supplied string like 1234@evil.example in the port field causes the legitimate host and port digits to be reinterpreted as userinfo, with evil.example promoted to the actual host. Downstream HTTP clients then connect to the attacker-controlled destination.

Root Cause

The root cause is missing input validation in the port serializer. RFC 3986 defines port = *DIGIT, but the vulnerable code path did not enforce this grammar before concatenation. The fix in versions 2.4.6, 3.1.7, and 4.1.4 makes recomposeAuthority reject any port value that is not a sequence of digits.

Attack Vector

Exploitation requires an application that (1) uses fast-uri to build URIs from component objects via serialize, normalize, or equal, and (2) allows untrusted input to reach the port field. Typical patterns include user-supplied redirect targets, webhook destinations, or callback URLs where individual URI components are extracted, modified, and reassembled. Because the resulting URI re-parses cleanly under both fast-uri and Node's URL, defensive re-validation of the built string does not detect the redirection.

The vulnerability manifests when an application accepts an object such as { scheme: 'https', host: 'trusted.example', port: '1234@evil.example', path: '/api' } and calls the serializer. The resulting URI resolves to evil.example at request time. See the GitHub Security Advisory GHSA-qw65-cvwx-89v3 for the full technical write-up.

Detection Methods for CVE-2026-84292

Indicators of Compromise

Outbound HTTP or HTTPS connections to hosts that do not match the intended destinations recorded in application logs.
URI strings containing non-digit characters, @ symbols, or path separators within the port position of the authority component.
Application logs showing successful serialization of URI objects where the port field contains non-numeric input.

Detection Strategies

Inventory Node.js applications and dependencies to identify use of fast-uri at versions below 2.4.6, 3.1.7, or 4.1.4 using npm ls fast-uri or software composition analysis tooling.
Add regex checks on outbound URI construction paths to flag any port field value not matching ^[0-9]+$ before serialization.
Correlate application-layer request logs with network egress telemetry to detect divergence between intended and actual destination hosts.

Monitoring Recommendations

Instrument HTTP client wrappers to log the parsed host of every outbound request and compare against an allowlist of expected destinations.
Alert on outbound connections from application servers to previously unseen external hosts, particularly from services that build URIs from user input.
Track dependency updates in CI pipelines and fail builds that introduce vulnerable fast-uri versions.

How to Mitigate CVE-2026-84292

Immediate Actions Required

Upgrade fast-uri to 2.4.6, 3.1.7, or 4.1.4 depending on the major version in use.
Audit application code for locations that assign untrusted data to the port field of URI component objects passed to serialize, normalize, or equal.
Add strict server-side validation that rejects non-numeric port values before they reach any URI builder.

Patch Information

The issue is fixed in fast-uri versions 2.4.6, 3.1.7, and 4.1.4. The patch updates recomposeAuthority to reject any port value that is not a digit sequence as required by RFC 3986. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-qw65-cvwx-89v3 for release notes.

Workarounds

Validate the port value against ^[0-9]{1,5}$ before populating the URI component object, and reject any request containing a non-conforming value.
Parse the constructed URI with Node's URL and compare the resulting host against an allowlist of expected hosts before issuing any outbound request.
Where feasible, avoid building URIs from user-controlled component objects and pass full URI strings through a strict allowlist parser instead.

bash

# Configuration example
npm install fast-uri@^4.1.4
npm ls fast-uri