https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:44:48 +0000 https://vulnerability.circl.lu/sighting/e33f2b52-6912-4001-9d18-665f506b4a7b/export {"uuid": "e33f2b52-6912-4001-9d18-665f506b4a7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://gist.github.com/alon710/d62c84bd4ce85042f1d6166de62a91ef", "content": "# CVE-2026-84292: CVE-2026-84292: Authority Injection in fast-uri via Unvalidated Port Component\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84292\n\n## Summary\nAn authority injection vulnerability exists in the serialization components of fast-uri (versions before 2.4.6, 3.1.7, and 4.1.4) where unvalidated port components can contain authority delimiters (such as '@'). This results in host demotion to userinfo, redirection of traffic to an arbitrary attacker-controlled host, and downstream Server-Side Request Forgery (SSRF) without causing parser errors in standard clients.\n\n## TL;DR\nUnvalidated port serialization in fast-uri allows remote attackers to perform authority injection and redirect connections to external hosts.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-116\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.0038\n- **Impact**: Integrity\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-uri\n- **fast-uri**: < 2.4.6 (Fixed in: `2.4.6`)\n- **fast-uri**: >= 3.0.0 < 3.1.7 (Fixed in: `3.1.7`)\n- **fast-uri**: >= 4.0.0 < 4.1.4 (Fixed in: `4.1.4`)\n\n## Mitigation\n\n- Upgrade fast-uri to version 2.4.6, 3.1.7, 4.1.4, or newer depending on the major version track.\n- Sanitize client-supplied input for port fields using a strict digits-only regular expression (/^\\d*$/) before passing them to URI serialization modules.\n\n**Remediation Steps:**\n1. Execute 'npm ls fast-uri' or 'yarn why fast-uri' to inspect the dependency tree and identify vulnerable versions of the package.\n2. Update package dependencies in package.json to reference safe versions: ^2.4.6, ^3.1.7, or ^4.1.4.\n3. Apply application-level validation logic to reject port parameters containing structural delimiters such as '@', '/', '?', or '#'.\n\n## References\n\n- [GitHub Security Advisory GHSA-qw65-cvwx-89v3](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [NVD - CVE-2026-84292](https://nvd.nist.gov/vuln/detail/CVE-2026-84292)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84292) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T03:30:32.000000Z"} {"uuid": "e33f2b52-6912-4001-9d18-665f506b4a7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://gist.github.com/alon710/d62c84bd4ce85042f1d6166de62a91ef", "content": "# CVE-2026-84292: CVE-2026-84292: Authority Injection in fast-uri via Unvalidated Port Component\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84292\n\n## Summary\nAn authority injection vulnerability exists in the serialization components of fast-uri (versions before 2.4.6, 3.1.7, and 4.1.4) where unvalidated port components can contain authority delimiters (such as '@'). This results in host demotion to userinfo, redirection of traffic to an arbitrary attacker-controlled host, and downstream Server-Side Request Forgery (SSRF) without causing parser errors in standard clients.\n\n## TL;DR\nUnvalidated port serialization in fast-uri allows remote attackers to perform authority injection and redirect connections to external hosts.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-116\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.0038\n- **Impact**: Integrity\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-uri\n- **fast-uri**: < 2.4.6 (Fixed in: `2.4.6`)\n- **fast-uri**: >= 3.0.0 < 3.1.7 (Fixed in: `3.1.7`)\n- **fast-uri**: >= 4.0.0 < 4.1.4 (Fixed in: `4.1.4`)\n\n## Mitigation\n\n- Upgrade fast-uri to version 2.4.6, 3.1.7, 4.1.4, or newer depending on the major version track.\n- Sanitize client-supplied input for port fields using a strict digits-only regular expression (/^\\d*$/) before passing them to URI serialization modules.\n\n**Remediation Steps:**\n1. Execute 'npm ls fast-uri' or 'yarn why fast-uri' to inspect the dependency tree and identify vulnerable versions of the package.\n2. Update package dependencies in package.json to reference safe versions: ^2.4.6, ^3.1.7, or ^4.1.4.\n3. Apply application-level validation logic to reject port parameters containing structural delimiters such as '@', '/', '?', or '#'.\n\n## References\n\n- [GitHub Security Advisory GHSA-qw65-cvwx-89v3](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [NVD - CVE-2026-84292](https://nvd.nist.gov/vuln/detail/CVE-2026-84292)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84292) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T03:30:32.000000Z"} https://vulnerability.circl.lu/sighting/e33f2b52-6912-4001-9d18-665f506b4a7b/export Tue, 29 Sep 2026 03:30:32 +0000 https://vulnerability.circl.lu/sighting/ec65e1c4-99ba-42c4-961c-8d7d896aa940/export {"uuid": "ec65e1c4-99ba-42c4-961c-8d7d896aa940", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mulhfzgof62o", "content": "fast-uri Turns Your Host Header Into a Courtesy Shuttle for Attackers\nPANIC 72% | Lag 0.0h | CVE-2026-84292 is a host injection flaw in fast-uri caused by unvalidated port input, allowing redir\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-09-03T02:59:43.934852Z"} {"uuid": "ec65e1c4-99ba-42c4-961c-8d7d896aa940", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mulhfzgof62o", "content": "fast-uri Turns Your Host Header Into a Courtesy Shuttle for Attackers\nPANIC 72% | Lag 0.0h | CVE-2026-84292 is a host injection flaw in fast-uri caused by unvalidated port input, allowing redir\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-09-03T02:59:43.934852Z"} https://vulnerability.circl.lu/sighting/ec65e1c4-99ba-42c4-961c-8d7d896aa940/export Thu, 03 Sep 2026 02:59:43 +0000 https://vulnerability.circl.lu/sighting/c030ba1a-256f-4140-9dbf-102e620f9bcc/export {"uuid": "c030ba1a-256f-4140-9dbf-102e620f9bcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mulbdoc74m2m", "content": "CVE-2026-84292 - Host Injection in fast-uri. Unvalidated port input allows redirection to attacker-controlled hosts. CVSS 7.5. Audit your dependencies now. #CVE #NodeJS #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-84292/", "creation_timestamp": "2026-09-03T01:11:04.055473Z"} {"uuid": "c030ba1a-256f-4140-9dbf-102e620f9bcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mulbdoc74m2m", "content": "CVE-2026-84292 - Host Injection in fast-uri. Unvalidated port input allows redirection to attacker-controlled hosts. CVSS 7.5. Audit your dependencies now. #CVE #NodeJS #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-84292/", "creation_timestamp": "2026-09-03T01:11:04.055473Z"} https://vulnerability.circl.lu/sighting/c030ba1a-256f-4140-9dbf-102e620f9bcc/export Thu, 03 Sep 2026 01:11:04 +0000 https://vulnerability.circl.lu/sighting/11f94c7e-e165-46a0-b51a-bdc0d7880c6f/export {"uuid": "11f94c7e-e165-46a0-b51a-bdc0d7880c6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117204442332805731", "content": "CVE-2026-84292 - Host Injection in fast-uri. Unvalidated port input allows redirection to attacker-controlled hosts. CVSS 7.5. Audit your dependencies now. #CVE #NodeJS #infosec\nhttps://www.valtersit.com/cve/CVE-2026-84292/", "creation_timestamp": "2026-09-03T01:11:03.952115Z"} {"uuid": "11f94c7e-e165-46a0-b51a-bdc0d7880c6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117204442332805731", "content": "CVE-2026-84292 - Host Injection in fast-uri. Unvalidated port input allows redirection to attacker-controlled hosts. CVSS 7.5. Audit your dependencies now. #CVE #NodeJS #infosec\nhttps://www.valtersit.com/cve/CVE-2026-84292/", "creation_timestamp": "2026-09-03T01:11:03.952115Z"} https://vulnerability.circl.lu/sighting/11f94c7e-e165-46a0-b51a-bdc0d7880c6f/export Thu, 03 Sep 2026 01:11:03 +0000 https://vulnerability.circl.lu/sighting/09404e50-f803-4a3d-84d5-4daf6d158d4c/export {"uuid": "09404e50-f803-4a3d-84d5-4daf6d158d4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mukzzawcjy2s", "content": "\ud83d\udfe0 CVE-2026-84292 - High (7.5)\n\nfast-uri serializes the port component of a URI without validating it. When recomposing the autho...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-84292/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-02T22:59:57.578216Z"} {"uuid": "09404e50-f803-4a3d-84d5-4daf6d158d4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84292", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mukzzawcjy2s", "content": "\ud83d\udfe0 CVE-2026-84292 - High (7.5)\n\nfast-uri serializes the port component of a URI without validating it. When recomposing the autho...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-84292/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-02T22:59:57.578216Z"} https://vulnerability.circl.lu/sighting/09404e50-f803-4a3d-84d5-4daf6d158d4c/export Wed, 02 Sep 2026 22:59:57 +0000