CVE-2026-84394: fast-uri SSRF Vulnerability

CVE-2026-84394 Overview

CVE-2026-84394 affects fast-uri, a URI parser widely used in the Node.js ecosystem including the Fastify web framework. The parser accepts hosts containing unbalanced or misplaced authority brackets without reporting an error. A host starting with [ but missing a closing ] is neither validated as an IPv6 literal nor canonicalized as a domain name. The parse() function returns the malformed string as the host with errors undefined, while Node's built-in URL and HTTP clients resolve the same string to a different host. This host mismatch enables Server-Side Request Forgery (SSRF) and policy bypass attacks against applications relying on fast-uri for host validation. The issue is classified as [CWE-436] Interpretation Conflict.

Critical Impact
Attackers can bypass SSRF denylists, redirect allowlists, and proxy routing policies by crafting URLs whose parsed host differs from the host reached by HTTP clients.

Affected Products

fast-uri version 2.4.5
fast-uri version 3.1.6
fast-uri version 4.1.3

Discovery Timeline

2026-09-03 - CVE-2026-84394 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84394

Vulnerability Analysis

The vulnerability stems from an interpretation conflict between fast-uri and Node.js's native URL parser. When an application uses fast-uri.parse() to extract the host from a URL for security policy evaluation, the parser accepts malformed authority components. The same URL string, when passed to an HTTP client built on Node's URL implementation, resolves to a different destination host.

This divergence enables Server-Side Request Forgery. An application that parses a user-supplied URL, verifies the extracted host against an SSRF denylist, and then forwards the original URL to fetch or http.request evaluates its policy against a string that is not the host the request actually reaches. The malformed host is also propagated through normalize(), equal(), and resolve(), extending the mismatch across the API surface.

Root Cause

The root cause is missing validation of authority brackets in the host parser. A host beginning with [ should be validated as an IPv6 literal per RFC 3986 and require a matching closing ]. In the affected versions, fast-uri reports no error for unbalanced brackets and does not fall back to domain name canonicalization. The errors field on the parse result remains undefined, giving downstream code a false signal that parsing succeeded.

Attack Vector

An attacker supplies a crafted URL containing an unbalanced bracket in the authority component, for example http://[evil.example.com/path. The application's host-based policy check reads [evil.example.com from fast-uri.parse() and matches it against a denylist that does not contain that literal string. The URL is then handed to an HTTP client, which parses the authority differently and issues a request to an unintended host such as an internal metadata service, admin endpoint, or attacker-controlled server. Refer to the GitHub Security Advisory GHSA-58mr-gqgx-xq4g for technical details.

Detection Methods for CVE-2026-84394

Indicators of Compromise

Outbound HTTP requests from application servers to internal IP ranges, cloud metadata endpoints (169.254.169.254), or unexpected external hosts.
Application logs where the parsed host differs from the destination host recorded by the HTTP client or upstream proxy.
Request URLs containing unbalanced [ characters in the authority component, such as http://[internal-host/.

Detection Strategies

Inventory Node.js applications and dependency trees for fast-uri at versions 2.4.5, 3.1.6, or 4.1.3, including transitive pulls via Fastify.
Correlate application-layer host decisions with egress proxy logs to detect host-string divergence.
Add web application firewall rules that flag URLs containing malformed IPv6 authority syntax.

Monitoring Recommendations

Log both the parsed host and the resolved request host at HTTP client egress points and alert on mismatches.
Monitor outbound traffic from workloads to cloud instance metadata endpoints and RFC 1918 ranges.
Track dependency updates for fast-uri and Fastify in software composition analysis pipelines.

How to Mitigate CVE-2026-84394

Immediate Actions Required

Upgrade fast-uri to version 2.4.6, 3.1.7, or 4.1.4 depending on the major version in use.
Audit application code paths that call fast-uri.parse() to make trust or routing decisions on user-supplied URLs.
Validate the errors field returned by parse() and reject any URL where host parsing reports a malformed authority.

Patch Information

The fix is released in fast-uri versions 2.4.6, 3.1.7, and 4.1.4. In the patched releases, parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-58mr-gqgx-xq4g for release notes.

Workarounds

Perform host validation using Node's built-in URL constructor rather than the fast-uri parse output when making security-sensitive decisions.
Enforce an outbound egress allowlist at the network layer to block requests to internal ranges and metadata endpoints.
Reject URLs at the input boundary that contain [ or ] characters unless a valid IPv6 literal is explicitly required.

bash

# Upgrade fast-uri to a patched release
npm install fast-uri@4.1.4
# or, for the 3.x line
npm install fast-uri@3.1.7
# or, for the 2.x line
npm install fast-uri@2.4.6

# Audit installed versions across the dependency tree
npm ls fast-uri