CVE-2026-84292

npm/fast-uri CVE-2026-84292: high 7.5, EPSS 0.24%

fast-uri vulnerable to authority injection via an unvalidated port in serialize

Action: Upgrade fast-uri to 2.4.6 or later.

npm i fast-uri@2.4.6

npm i fast-uri@3.1.7

npm i fast-uri@4.1.4

Affected

Fixed versions

Sources

• osv: GHSA-qw65-cvwx-89v3
• https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3
• https://nvd.nist.gov/vuln/detail/CVE-2026-84292
• https://github.com/fastify/fast-uri/commit/820e8478dd7da3d09f187bfaf35d50b71f67b8b4
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.6
• https://github.com/fastify/fast-uri/releases/tag/v3.1.7
• https://github.com/fastify/fast-uri/releases/tag/v4.1.4

CVE-2026-84292 · published 2026-09-28T21:24:39Z · modified 2026-09-28T21:45:03.859117836Z · JSON