{"vulnerability": "cve-2026-84394", "sightings": [{"uuid": "5af6572c-15fa-4d7d-bc21-894dd0baaf90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84394", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mukrku2rxk2z", "content": "\ud83d\udea8 High-severity security fix in fast-uri (4.1.4, 3.1.7, 2.4.6) just released!\n\nPatches CVE-2026-84394: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-09-02T20:28:45.329400Z"}, {"uuid": "1c9151e8-398d-4825-94a8-1f01cd2f3fca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84394", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mumcz67nq32u", "content": "fast-uri v2.4.5, v3.1.6, v4.1.3\u3067\u3001\u4e0d\u6b63\u306a\u30db\u30b9\u30c8\u540d\u3067\u3082\u30a8\u30e9\u30fc\u306b\u306a\u3089\u305a\u3001URL\u30d1\u30fc\u30b5\u30fc\u3068HTTP\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3067\u7570\u306a\u308b\u30db\u30b9\u30c8\u3068\u3057\u3066\u6271\u308f\u308c\u308b\u8106\u5f31\u6027\u3002\nCVE-2026-84394 CVSS 7.5 | HIGH", "creation_timestamp": "2026-09-03T11:13:37.491691Z"}, {"uuid": "3232f647-21e1-49ef-a4cf-c66c37e54ce3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84394", "type": "seen", "source": "https://gist.github.com/alon710/d71ae5a7c954065eba037dd00ecd2388", "content": "# CVE-2026-84394: CVE-2026-84394: Host Confusion and SSRF Bypass via Parser Discrepancy in fast-uri\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84394\n\n## Summary\nAn interpretation conflict in the fast-uri library allows unauthenticated remote attackers to bypass Server-Side Request Forgery filters due to inconsistent handling of malformed bracket notation in hostnames.\n\n## TL;DR\nMalformed URLs with unbalanced brackets bypass fast-uri checks but resolve to internal hosts in WHATWG HTTP clients, enabling SSRF.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-436\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.0038\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- fast-uri npm library\n- **fast-uri**: 2.4.5 (Fixed in: `2.4.6`)\n- **fast-uri**: 3.1.6 (Fixed in: `3.1.7`)\n- **fast-uri**: 4.1.3 (Fixed in: `4.1.4`)\n\n## Mitigation\n\n- Upgrade fast-uri to safe versions (2.4.6, 3.1.7, 4.1.4)\n- Align the validation parser with the request execution engine\n- Perform pre-flight DNS checks and direct IP verification\n\n**Remediation Steps:**\n1. Identify all dependency paths involving fast-uri.\n2. Explicitly update fast-uri inside package.json dependencies, overrides, or resolutions.\n3. Run the package manager update script to implement the secure release.\n4. Redesign security validators to use WHATWG URL API instead of fast-uri.\n\n## References\n\n- [GitHub Security Advisory GHSA-58mr-gqgx-xq4g](https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g)\n- [OpenJS Foundation Advisory Portal](https://cna.openjsf.org/security-advisories.html)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-84394)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-84394)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84394) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T04:30:32.000000Z"}]}