fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
### Impact `fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without reporting an error. A host that starts with `[` but does not end with `]`, such as `[@127.0.0.1`, is neither validated as an IP literal nor canonicalized as a domain name, so `parse()` returns it as the host with `error` undefined, while Node's `URL` (and `http.get`, `axios`, `got`, and other clients built on it) resolve the same string to `127.0.0.1`. An application that reads `parse().host` to make a host decision (an SSRF denylist, a redirect allowlist, or proxy routing) and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through `normalize()`, `equal()`, and `resolve()`. ### Patches This vulnerability has been patched in fast-uri `4.1.4`, `3.1.7`, and `2.4.6`. `parse()` now reports `URI host is malformed.` for any host that contains a bracket but is not a valid `[IPv6]` literal. All users should upgrade. ### Workarounds If upgrading is not immediately possible, reject any URL whose host contains a `[` or `]` that is not a well-formed IPv6 literal before making a host decision. Clients that fail closed on credential-bearing URLs, such as Node's global `fetch()`, are not affected by the reported vector.
GHSA-58mr-gqgx-xq4g
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-58mr-gqgx-xq4g
fast-uri
Source reference: /affected/0/package/name
- Affected versions
- 2.4.5
Source reference:
/affected/0/versions - Fixed versions
- 2.4.6
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
fast-uri
Source reference: /affected/1/package/name
- Affected versions
- 3.1.6
Source reference:
/affected/1/versions - Fixed versions
- 3.1.7
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
fast-uri
Source reference: /affected/2/package/name
- Affected versions
- 4.1.3
Source reference:
/affected/2/versions - Fixed versions
- 4.1.4
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "2.4.5"
},
{
"fixed": "2.4.6"
}
]
}
],
"package": {
"name": "fast-uri",
"purl": "pkg:npm/fast-uri",
"ecosystem": "npm"
},
"versions": [
"2.4.5"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-58mr-gqgx-xq4g/GHSA-58mr-gqgx-xq4g.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "3.1.6"
},
{
"fixed": "3.1.7"
}
]
}
],
"package": {
"name": "fast-uri",
"purl": "pkg:npm/fast-uri",
"ecosystem": "npm"
},
"versions": [
"3.1.6"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-58mr-gqgx-xq4g/GHSA-58mr-gqgx-xq4g.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "4.1.3"
},
{
"fixed": "4.1.4"
}
]
}
],
"package": {
"name": "fast-uri",
"purl": "pkg:npm/fast-uri",
"ecosystem": "npm"
},
"versions": [
"4.1.3"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-58mr-gqgx-xq4g/GHSA-58mr-gqgx-xq4g.json"
}
}
]- Related CVEs
- CVE-2026-84394
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #23661 · Revision 1
- Added to Heist Feed
- Publisher date