CVE-2026-84292 is a high-severity vulnerability in fast-uri, a dependency-free URI parsing and serialization library for JavaScript/Node.js maintained under the OpenJS Foundation, and one of the most widely-used packages in the Node.js ecosystem.

The following version(s) are affected:

fast-uri before 2.4.6 – (Affected)
fast-uri 3.0.0 up to (but not including) 3.1.7, and 4.0.0 up to (but not including) 4.1.4 – (Affected)
fast-uri 2.4.6, 3.1.7, and 4.1.4, and later on each respective branch – (Not affected, patched)

Typical attack flow:

1. Supply a crafted port value to an application using fast-uri — An attacker supplies a URI or URI-like input containing a non-numeric "port" value (for example, one that begins with an "@" character) to an application that uses fast-uri to parse and then re-serialize that URI.
2. Redirect the reconstructed authority to an attacker-controlled host — Because fast-uri concatenates the unvalidated port value into the serialized output, the malicious port value injects an authority delimiter, demoting the application's intended trusted host to a userinfo field and causing the reconstructed URI to actually point at an attacker-controlled host.

Attack vectors:

• A network-based, unauthenticated input against any application that uses an affected version of fast-uri (directly or transitively via ajv/Fastify) to parse and re-serialize URI data supplied by an untrusted party.
• No user interaction, no privileges, and no special access conditions are required (CVSS AV:N/AC:L/PR:N/UI:N).

Successful exploitation may allow attackers to:

• Cause an application to misinterpret an attacker-controlled host as the intended, trusted host after URI serialization, undermining any host-based allowlist, trust decision, or routing logic built on top of fast-uri's output.
• Depending on how the affected application uses the resulting (incorrect) authority — for example, to make an internal request, issue a redirect, or authorize access to a downstream resource — potentially achieve server-side request forgery, an open redirect, or unauthorized access to internal systems the application did not intend to expose.

CERTVU recommends the following:

1. Apply the Vendor Patch Without Delay

   Upgrade fast-uri to version 2.4.6, 3.1.7, or 4.1.4 (whichever branch applies), where this vulnerability is fixed (GitHub Security Advisory GHSA-qw65-cvwx-89v3). Where fast-uri is a transitive dependency, upgrade the direct dependency (such as ajv or Fastify) to a version that bundles the fixed release.

2. Audit for the fast-uri Dependency

   Audit every application for a fast-uri dependency, direct or transitive, since this library is commonly pulled in indirectly and easy to overlook.

3. Review Code That Trusts the Serialized Authority

   Review any code that treats a fast-uri-serialized URI's host or authority as trusted.

4. Prioritize Unpatched Internet-Facing Applications

   Treat any unpatched, internet-facing application using fast-uri for untrusted URI input as a priority remediation target.

5. Review Logs for Unexpected Authority/Host Values

   Review logs for unexpected authority/host values.

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.