{"uuid": "03af3fae-fece-4045-b45e-5b726ec71963", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-qw65-cvwx-89v3", "type": "seen", "source": "https://gist.github.com/alon710/d62c84bd4ce85042f1d6166de62a91ef", "content": "# CVE-2026-84292: CVE-2026-84292: Authority Injection in fast-uri via Unvalidated Port Component\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84292\n\n## Summary\nAn authority injection vulnerability exists in the serialization components of fast-uri (versions before 2.4.6, 3.1.7, and 4.1.4) where unvalidated port components can contain authority delimiters (such as '@'). This results in host demotion to userinfo, redirection of traffic to an arbitrary attacker-controlled host, and downstream Server-Side Request Forgery (SSRF) without causing parser errors in standard clients.\n\n## TL;DR\nUnvalidated port serialization in fast-uri allows remote attackers to perform authority injection and redirect connections to external hosts.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-116\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.0038\n- **Impact**: Integrity\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-uri\n- **fast-uri**: < 2.4.6 (Fixed in: `2.4.6`)\n- **fast-uri**: >= 3.0.0 < 3.1.7 (Fixed in: `3.1.7`)\n- **fast-uri**: >= 4.0.0 < 4.1.4 (Fixed in: `4.1.4`)\n\n## Mitigation\n\n- Upgrade fast-uri to version 2.4.6, 3.1.7, 4.1.4, or newer depending on the major version track.\n- Sanitize client-supplied input for port fields using a strict digits-only regular expression (/^\\d*$/) before passing them to URI serialization modules.\n\n**Remediation Steps:**\n1. Execute 'npm ls fast-uri' or 'yarn why fast-uri' to inspect the dependency tree and identify vulnerable versions of the package.\n2. Update package dependencies in package.json to reference safe versions: ^2.4.6, ^3.1.7, or ^4.1.4.\n3. Apply application-level validation logic to reject port parameters containing structural delimiters such as '@', '/', '?', or '#'.\n\n## References\n\n- [GitHub Security Advisory GHSA-qw65-cvwx-89v3](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [NVD - CVE-2026-84292](https://nvd.nist.gov/vuln/detail/CVE-2026-84292)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84292) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T03:30:32.000000Z"}