Description
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose port is @127.0.0.1:8124 produces http://trusted.example:@127.0.0.1:8124/app, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 4.1.4 >= 3.0.0, < 3.1.7 < 2.4.6** Patched version(s): **4.1.4 3.1.7 2.4.6**
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to authority injection via an unvalidated port in serialize and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to host confusion via backslash authority introducer - CVE-2026-18446
- fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority - CVE-2026-84394
- fast-uri vulnerable to host confusion via literal backslash authority delimiter - CVE-2026-16221
- fast-uri vulnerable to host confusion via percent-encoded authority delimiters - CVE-2026-6322
