Skip to content
Fencer Vulns
high 7.5

CVE-2026-84394 json

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

published 2026-09-02 2 mo ago modified 2026-09-28 41 d ago also GHSA-58mr-gqgx-xq4g , EUVD-2026-70282

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits
0
none known

Summary

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.

Patch / fix

  • npm fast-uri 2.4.6, 3.1.7, 4.1.4
  • fast-uri fast-uri 2.4.6, 3.1.7, 4.1.4
  • node-ajv Debian 14 8.20.0~ds+~cs7.1.5-1

debian advisories DEBIAN-CVE-2026-84394

  • foreman satellite utils 6.19, satellite capsule 6.19, satellite 6.19 3.18.0.14-1.el9sat
  • foreman-cli satellite utils 6.19, satellite 6.19 3.18.0.14-1.el9sat
  • foreman-ec2 satellite 6.19 3.18.0.14-1.el9sat
  • foreman-pcp satellite capsule 6.19, satellite 6.19 3.18.0.14-1.el9sat
  • foreman-redis satellite 6.19 3.18.0.14-1.el9sat
  • foreman-vmware satellite 6.19 3.18.0.14-1.el9sat
  • foreman-libvirt satellite 6.19 3.18.0.14-1.el9sat
  • foreman-service satellite 6.19 3.18.0.14-1.el9sat

red hat advisories RHSA-2026:74503RHSA-2026:65617RHSA-2026:65537RHSA-2026:63782

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-84394 updated cvss 7.5

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

  • Red Hat Cost Management On Premise costmanagement/costmanagement-ui-rhel10 Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
    affected: no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9, +3 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel9 Red Hat build of Apache Camel - HawtIO 4 rhaf-hawtio-maven-repository.zip 4.4.0.GA Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8 Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9
    affected: no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +5 more Red Hat OpenShift Container Platform 5 openshift5/ose-monitoring-plugin-rhel9, openshift5/nmstate-console-plugin-rhel9 Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, rhceph-dev/odf4-mcg-core-rhel9, odf4/odf-multicluster-console-rhel9 Red Hat Satellite 6 nodejs-webpack 5.104.1-1.el9sat, nodejs-mini-css-extract-plugin 2.10.0-1.el9sat, nodejs-compression-webpack-plugin 10.0.0-2.el9sat
    affected: no fix available
  • Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9 1790854494
    fixed: vendor fix RHSA-2026:74609
  • Red Hat Network Observability (NETOBSERV) 1.12.3 network-observability/network-observability-console-plugin-rhel9 1789978277, network-observability/network-observability-console-plugin-pf5-rhel9 1789978780
    fixed: vendor fix RHSA-2026:70593
show 22 more
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1788775748
    fixed: vendor fix RHSA-2026:65118
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1788783591, ansible-automation-platform/bootc-automation-portal-rhel9 1791865660
    fixed: vendor fix RHSA-2026:65155
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-tech-preview/mcp-server-rhel9 1789669036
    fixed: vendor fix RHSA-2026:71179
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/mcp-server-rhel9 1789518969
    fixed: vendor fix RHSA-2026:71177
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1789554285
    fixed: vendor fix RHSA-2026:69248
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1791311495, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator 1791250003, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend 1791242697, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend 1791251282, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets 1791250794, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki 1791250355, +1 more
    fixed: vendor fix RHSA-2026:76788
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1789677459
    fixed: vendor fix RHSA-2026:69289
  • Red Hat Edge Manager 1.1 rhem/flightctl-ui-rhel10 1789486181, rhem/flightctl-ui-ocp-rhel9 1789486446, rhem/flightctl-ui-ocp-rhel10 1789486226
    fixed: vendor fix RHSA-2026:68044
  • Red Hat Edge Manager 1.2 rhem/flightctl-ui-rhel9 1789486750, rhem/flightctl-ui-rhel10 1789488111, rhem/flightctl-ui-ocp-rhel9 1789486476, rhem/flightctl-ui-ocp-rhel10 1789485920
    fixed: vendor fix RHSA-2026:68006
  • Red Hat Hardened Images grafana12.4 12.4.9-0.6.hum1, grafana13.1 13.1.3-0.6.hum1, grafana13.2 13.2.1-0.2.hum1
    fixed: vendor fix RHSA-2026:63782
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1789546373
    fixed: vendor fix RHSA-2026:68681
  • Red Hat OpenShift AI 2.25 rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1791288400
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-feature-server-rhel9 1791863220, rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1791788267
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift AI 3.5 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1791825469
    fixed: vendor fix RHSA-2026:86891
  • Red Hat OpenShift Container Platform 4.18 openshift4/nmstate-console-plugin-rhel9 1790828012
    fixed: vendor fix RHSA-2026:79040
  • Red Hat OpenShift Container Platform 4.19 openshift4/nmstate-console-plugin-rhel9 1790609954
    fixed: vendor fix RHSA-2026:74435
  • Red Hat OpenShift Container Platform 4.20 openshift4/nmstate-console-plugin-rhel9 1789517682
    fixed: vendor fix RHSA-2026:68543
  • Red Hat OpenShift Container Platform 4.21 openshift4/nmstate-console-plugin-rhel9 1789592806
    fixed: vendor fix RHSA-2026:68547
  • Red Hat OpenShift Container Platform 4.22 openshift4/nmstate-console-plugin-rhel9 1789567849
    fixed: vendor fix RHSA-2026:68553
  • Red Hat Openshift Data Foundation 4.19 odf4/odf-console-rhel9 1793126829
    fixed: vendor fix RHSA-2026:92650
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/openvsx-rhel9 1789144269, devspaces/dashboard-rhel9 1789162884
    fixed: vendor fix RHSA-2026:68754
  • Red Hat OpenShift Dev Spaces 3.31 devspaces/code-rhel9 1792599388, devspaces/pluginregistry-rhel9 1792495212
    fixed: vendor fix RHSA-2026:90321

5 more fixed, 41 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm fast-uri
>=2.4.5, <2.4.6
>=3.1.6, <3.1.7
>=4.1.3, <4.1.4
2.4.6
3.1.7
4.1.4

Affected products

  • fast-uri fast-uri

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.