{"items":[{"id":"NVI-00013212","kind":"vulnerability","title":"fast-uri vulnerable to authority injection via an unvalidated port in serialize","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-qw65-cvwx-89v3","CVE-2026-84292"],"plain_summary":"GitHub lists this reviewed advisory for fast-uri, fast-uri, fast-uri. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4a639349d0822a056fb8c7a4a0ddfdfd"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-28T21:24:40.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-93bc4c6e2dd3206ec57830743cc58bd4"},{"kind":"CVSS","as_of":"2026-10-06T22:10:00.247Z","value":"7.5 HIGH (3.1)","meaning":"ce714d77-add3-4f53-aff5-83d477b104bb severity; no combined Null risk score.","source_id":"sr-4a639349d0822a056fb8c7a4a0ddfdfd"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-93bc4c6e2dd3206ec57830743cc58bd4","url":"https://github.com/advisories/GHSA-qw65-cvwx-89v3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qw65-cvwx-89v3","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:25.558Z"},{"id":"sr-4a639349d0822a056fb8c7a4a0ddfdfd","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-84292","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-04T09:59:21.684Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-93bc4c6e2dd3206ec57830743cc58bd4"],"technology":"fast-uri","known_exclusions":[],"conditions_summary":"### Impact\n\n`fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port verbatim, so a `port` value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose `port` is `@127.0.0.1:8124` produces `http://trusted.example:@127.0.0.1:8124/app`, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both `fast-uri` and Node's `URL` read the result back as the attacker's host with no error, so re-validating the built URI does not catch it.\n\nThis affects applications that build URIs from parts and assign untrusted data to the `port` component (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable through `serialize()`, `normalize()`, and `equal()` in their object forms. A `port` obtained from `parse()` is always digits and is not affected.\n\n### Patches\n\nThis vulnerability has been patched in fast-uri `4.1.4`, `3.1.7`, and `2.4.6`. `recomposeAuthority` now rejects any port that is not `*DIGIT` per RFC 39","public_affected_ranges":["< 2.4.6"]},{"certainty":"source_listed","source_ids":["sr-93bc4c6e2dd3206ec57830743cc58bd4"],"technology":"fast-uri","known_exclusions":[],"conditions_summary":"### Impact\n\n`fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port verbatim, so a `port` value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose `port` is `@127.0.0.1:8124` produces `http://trusted.example:@127.0.0.1:8124/app`, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both `fast-uri` and Node's `URL` read the result back as the attacker's host with no error, so re-validating the built URI does not catch it.\n\nThis affects applications that build URIs from parts and assign untrusted data to the `port` component (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable through `serialize()`, `normalize()`, and `equal()` in their object forms. A `port` obtained from `parse()` is always digits and is not affected.\n\n### Patches\n\nThis vulnerability has been patched in fast-uri `4.1.4`, `3.1.7`, and `2.4.6`. `recomposeAuthority` now rejects any port that is not `*DIGIT` per RFC 39","public_affected_ranges":[">= 3.0.0, < 3.1.7"]},{"certainty":"source_listed","source_ids":["sr-93bc4c6e2dd3206ec57830743cc58bd4"],"technology":"fast-uri","known_exclusions":[],"conditions_summary":"### Impact\n\n`fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port verbatim, so a `port` value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose `port` is `@127.0.0.1:8124` produces `http://trusted.example:@127.0.0.1:8124/app`, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both `fast-uri` and Node's `URL` read the result back as the attacker's host with no error, so re-validating the built URI does not catch it.\n\nThis affects applications that build URIs from parts and assign untrusted data to the `port` component (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable through `serialize()`, `normalize()`, and `equal()` in their object forms. A `port` obtained from `parse()` is always digits and is not affected.\n\n### Patches\n\nThis vulnerability has been patched in fast-uri `4.1.4`, `3.1.7`, and `2.4.6`. `recomposeAuthority` now rejects any port that is not `*DIGIT` per RFC 39","public_affected_ranges":[">= 4.0.0, < 4.1.4"]}],"null_published_at":"2026-11-05T19:10:23.248Z","source_updated_at":"2026-09-28T21:24:40.000Z","source_disclosed_at":"2026-09-28T21:24:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T07:24:25.558Z"},{"id":"NVI-00013212","kind":"vulnerability","title":"fast-uri vulnerable to authority injection via an unvalidated port in serialize","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qw65-cvwx-89v3","CVE-2026-84292"],"plain_summary":"GitHub lists this reviewed advisory for fast-uri, fast-uri, fast-uri. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-93bc4c6e2dd3206ec57830743cc58bd4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-28T21:24:40.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-93bc4c6e2dd3206ec57830743cc58bd4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-93bc4c6e2dd3206ec57830743cc58bd4","url":"https://github.com/advisories/GHSA-qw65-cvwx-89v3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qw65-cvwx-89v3","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:25.558Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-93bc4c6e2dd3206ec57830743cc58bd4"],"technology":"fast-uri","known_exclusions":[],"conditions_summary":"### Impact\n\n`fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port verbatim, so a `port` value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose `port` is `@127.0.0.1:8124` produces `http://trusted.example:@127.0.0.1:8124/app`, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both `fast-uri` and Node's `URL` read the result back as the attacker's host with no error, so re-validating the built URI does not catch it.\n\nThis affects applications that build URIs from parts and assign untrusted data to the `port` component (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable through `serialize()`, `normalize()`, and `equal()` in their object forms. A `port` obtained from `parse()` is always digits and is not affected.\n\n### Patches\n\nThis vulnerability has been patched in fast-uri `4.1.4`, `3.1.7`, and `2.4.6`. `recomposeAuthority` now rejects any port that is not `*DIGIT` per RFC 39","public_affected_ranges":["< 2.4.6"]},{"certainty":"source_listed","source_ids":["sr-93bc4c6e2dd3206ec57830743cc58bd4"],"technology":"fast-uri","known_exclusions":[],"conditions_summary":"### Impact\n\n`fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port verbatim, so a `port` value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose `port` is `@127.0.0.1:8124` produces `http://trusted.example:@127.0.0.1:8124/app`, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both `fast-uri` and Node's `URL` read the result back as the attacker's host with no error, so re-validating the built URI does not catch it.\n\nThis affects applications that build URIs from parts and assign untrusted data to the `port` component (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable through `serialize()`, `normalize()`, and `equal()` in their object forms. A `port` obtained from `parse()` is always digits and is not affected.\n\n### Patches\n\nThis vulnerability has been patched in fast-uri `4.1.4`, `3.1.7`, and `2.4.6`. `recomposeAuthority` now rejects any port that is not `*DIGIT` per RFC 39","public_affected_ranges":[">= 3.0.0, < 3.1.7"]},{"certainty":"source_listed","source_ids":["sr-93bc4c6e2dd3206ec57830743cc58bd4"],"technology":"fast-uri","known_exclusions":[],"conditions_summary":"### Impact\n\n`fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port verbatim, so a `port` value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose `port` is `@127.0.0.1:8124` produces `http://trusted.example:@127.0.0.1:8124/app`, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both `fast-uri` and Node's `URL` read the result back as the attacker's host with no error, so re-validating the built URI does not catch it.\n\nThis affects applications that build URIs from parts and assign untrusted data to the `port` component (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable through `serialize()`, `normalize()`, and `equal()` in their object forms. A `port` obtained from `parse()` is always digits and is not affected.\n\n### Patches\n\nThis vulnerability has been patched in fast-uri `4.1.4`, `3.1.7`, and `2.4.6`. `recomposeAuthority` now rejects any port that is not `*DIGIT` per RFC 39","public_affected_ranges":[">= 4.0.0, < 4.1.4"]}],"null_published_at":"2026-11-01T07:29:12.929Z","source_updated_at":"2026-09-28T21:24:40.000Z","source_disclosed_at":"2026-09-28T21:24:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:24:25.558Z"}],"next_cursor":null,"snapshot_revision":"42594"}