Description
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket ([ or ]) without reporting an error. A host that starts with [ but does not end with ], such as [@127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node’s URL (and http.get, axios, got, and other clients built on it) resolve the same string to 127.0.0.1.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **= 4.1.3 = 3.1.6 = 2.4.5** Patched version(s): **4.1.4 3.1.7 2.4.6**
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to host confusion via percent-encoded authority delimiters - CVE-2026-6322
- fast-uri vulnerable to host confusion via literal backslash authority delimiter - CVE-2026-16221
- fast-uri vulnerable to host confusion via backslash authority introducer - CVE-2026-18446
- fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization - CVE-2026-110180
You might also like:
See something that needs correcting? Let us knowUpdated September 28, 2026