---
cve: "CVE-2026-84394"
severity: "HIGH"
cvss: 7.5
epss: "0.4%"
vendor: "fast-uri"
kev: false
exploited: false
published: "2026-09-03 05:16:38"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-03T03:28:36+02:00"
---

# CVE-2026-84394

> 7.5 HIGH · 🧪 PoC

## Beschreibung

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Patch verfügbar (OSV)

- ccd1f8dce460fd7ab47767ff11ceeaddb730916a (Commit)
- 412e40abd4eb8beabfb952d80abf949a2baf27a3 (Commit)

## BSI-Hinweise (deutsch)

- [Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3555) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.

## Referenzen

- <https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g>
- <https://cna.openjsf.org/security-advisories.html>
- <https://nvd.nist.gov/vuln/detail/CVE-2026-84394>
- <https://github.com/fastify/fast-uri/pull/214>
- <https://github.com/fastify/fast-uri/commit/e00815236bc94107e44ef1b2f5318a06bac225c0>
- <https://github.com/fastify/fast-uri/releases/tag/v2.4.6>
- <https://github.com/fastify/fast-uri/releases/tag/v3.1.7>
- <https://github.com/fastify/fast-uri/releases/tag/v4.1.4>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-84394) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_