CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.

• CWE-116

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3Mitigation, Vendor Advisory

Published

Sep 2, 2026

Last Modified

Oct 6, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84286ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied in…9.8
• CVE-2026-84287A flaw has been found in NousResearch hermes-agent 0.18.0. A…4.3
• CVE-2026-84288A vulnerability has been found in NousResearch hermes-agent …4.3
• CVE-2026-84289A vulnerability was found in NousResearch hermes-agent up to…4.3
• CVE-2026-8429SPIP versions prior to 4.4.14 contain a remote code executio…8.8
• CVE-2026-84290IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by…5.1
• CVE-2026-84293The Repeater Fields for Gravity Forms plugin for WordPress i…7.2
• CVE-2026-84294Improper limitation of pathname in the Ad Hoc Transfer compo…7.7
• CVE-2026-84295Improper authentication in Progress Software WS_FTP Server v…10
• CVE-2026-84296Multi-Factor Authentication Bypass vulnerability in SSH comp…6.8
• CVE-2026-84298Hatchet is a platform for orchestrating background tasks, AI…3.1
• CVE-2026-8430SPIP versions prior to 4.4.14 contain a remote code executio…9.2