CVE-2026-84292

fast-uri serializes the port component of a URI without validating it, so when the authority is recomposed a non-numeric port value containing characters such as '@' or ':' can inject authority delimiters into the string. Applications that build URIs from parts and assign untrusted data to the port component, then call serialize, normalize, or equal in their object forms, can have the intended host demoted to userinfo and the URI's authority silently repointed at an attacker-controlled host. Both fast-uri and Node's built-in URL parser read the recomposed URI back as the attacker's host without error, so re-validating the built URI does not catch the manipulation, enabling host-allowlist bypass, potential credential exposure via the userinfo component, and integrity-only attacks (CVSS 3.1 7.5, C:N/I:H/A:N). Anyone using fast-uri before 2.4.6, from 3.0.0 before 3.1.7, or from 4.0.0 before 4.1.4 who passes untrusted values into the port component is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.2% chance of exploitation within 30 days, so it is not currently known to be exploited in the wild.

What to do: Upgrade fast-uri to 2.4.6 (2.x line), 3.1.7 (3.x line), or 4.1.4 (4.x line), where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986; use 'npm ls fast-uri' or lockfile review to find which of your builds pull in vulnerable versions. Until patched, validate that any user-supplied port is purely numeric before assigning it to the port component, and review SSRF or host-allowlist logic that trusts URIs rebuilt from parts with fast-uri or Node's URL parser.