Bug 2527747 (CVE-2026-84292)

Summary: CVE-2026-84292 fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, abrianik, akhatavk, alizardo, anpicker, anthomas, aos-team-art-private, aruklets, asdas, ataylor, bbrownin, bparees, brasmith, bsmejkal, cdrage, cmyers, cochase, csuconic, dbruscin, dhanak, dnakabaa, doconnor, dpaolell, dranck, drosa, dschmidt, dsimansk, dymurray, ehelms, ehugonne, ewittman, ggainey, ggrzybek, gparvin, gtully, hasun, ibolton, jachapma, janstey, jbalunas, jchui, jdelft, jfula, jhe, jlanda, jmatthew, jmontleo, jowilson, jpasqual, jraez, jsherman, jupierce, juwatts, jwong, kaycoth, kingland, kshier, ktsao, kvanderr, lchilton, lcouzens, lgarciaa, lryznaro, mbiarnes, mdellweg, mhulan, mnovotny, mreynolds, msauton, mstipich, nboldt, nipatil, nmoumoul, nyancey, oaljalju, omaciel, ometelka, osousa, pantinor, parichar, pcreech, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, progier, psrna, ptisnovs, rchan, rexwhite, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rkubis, rushinde, sausingh, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, snegrini, spichugi, sseago, stcannon, sthirugn, suppawar, syedriko, tasato, tbish, tbordaz, teagle, tlavocat, tmalecek, tsze, ttakamiy, vashirov, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2537714, 2537715, 2537717, 2537719, 2537720, 2537721, 2537722, 2537723, 2537725, 2537726, 2537727, 2537729, 2537730, 2537732, 2537734, 2537735, 2537737, 2537738, 2537739, 2537740, 2537741, 2537742, 2537716, 2537718, 2537724, 2537731, 2537733, 2537736, 2543361    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-02 20:31:59 UTC 
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.
Comment 1 Jon Orris 2026-09-24 11:02:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:71543 https://access.redhat.com/errata/RHSA-2026:71543