Bug 2527756 (CVE-2026-84394)

Summary:	CVE-2026-84394 fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abarbaro, abrianik, akhatavk, alizardo, anpicker, anthomas, aos-team-art-private, aruklets, asdas, ataylor, bbrownin, bparees, brasmith, bsmejkal, cdrage, cmah, cmyers, cochase, csuconic, dbruscin, dhanak, dnakabaa, doconnor, dpaolell, dranck, drosa, dschmidt, dsimansk, dymurray, eaguilar, ebaron, ehelms, ehugonne, ewittman, ggainey, ggrzybek, gparvin, gtully, hasun, ibolton, jachapma, janstey, jbalunas, jchui, jdelft, jfula, jhe, jlanda, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jraez, jsherman, jtolenti, jupierce, juwatts, jwong, kaycoth, kingland, kshier, ktsao, kvanderr, lchilton, lcouzens, lgarciaa, lryznaro, mbiarnes, mdellweg, mhulan, mnovotny, mreynolds, msauton, mstipich, nboldt, nipatil, nmoumoul, nyancey, oaljalju, omaciel, ometelka, osousa, pantinor, parichar, pcreech, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, progier, psrna, ptisnovs, rbobbitt, rchan, rexwhite, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rkubis, rushinde, sausingh, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, snegrini, spichugi, sseago, stcannon, sthirugn, suppawar, syedriko, tasato, tbish, tbordaz, teagle, tlavocat, tmalecek, tsze, vashirov, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2543357
Bug Blocks:

Description OSIDB Bzimport 2026-09-02 20:45:56 UTC

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.