CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.

• CWE-116

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3Mitigation, Vendor Advisory

Published

Sep 2, 2026

Last Modified

Sep 4, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84283Secure Folder 1.2 stores files selected for its password-pro…6.8
• CVE-2026-84285An OS Command Injection vulnerability affecting Tuleap Enter…8.8
• CVE-2026-84287A flaw has been found in NousResearch hermes-agent 0.18.0. A…4.3
• CVE-2026-84288A vulnerability has been found in NousResearch hermes-agent …4.3
• CVE-2026-84289A vulnerability was found in NousResearch hermes-agent up to…4.3
• CVE-2026-8429SPIP versions prior to 4.4.14 contain a remote code executio…8.8
• CVE-2026-84293The Repeater Fields for Gravity Forms plugin for WordPress i…7.2
• CVE-2026-84298Hatchet is a platform for orchestrating background tasks, AI…3.1
• CVE-2026-8430SPIP versions prior to 4.4.14 contain a remote code executio…9.2
• CVE-2026-84301FastGPT is an open-source LLM platform for building AI appli…6.3
• CVE-2026-84302Discourse is an open-source discussion platform. Prior to 20…4.2
• CVE-2026-84303gRPC-Go is the Go language implementation of gRPC. Prior to …6.3