fast-uri vulnerable to host confusion via an unclosed bracket in the URI authorityGHSA-58mr-gqgx-xq4g
HIGHFix: fastify/fast-uri#214GHSA-58mr-gqgx-xq4g is a high-severity (CVSS 7.5) CWE-436 vulnerability in fast-uri. A fix is available for fast-uri — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-58mr-gqgx-xq4g.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-58mr-gqgx-xq4g by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
fast-urinpmDescription
Impact
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket ([ or ]) without reporting an error. A host that starts with [ but does not end with ], such as [@127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL (and http.get, axios, got, and other clients built on it) resolve the same string to 127.0.0.1. An application that reads parse().host to make a host decision (an SSRF denylist, a redirect allowlist, or proxy routing) and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize(), equal(), and resolve().
Patches
This vulnerability has been patched in fast-uri 4.1.4, 3.1.7, and 2.4.6. parse() now reports URI host is malformed. for any host that contains a bracket but is not a valid [IPv6] literal. All users should upgrade.
Workarounds
If upgrading is not immediately possible, reject any URL whose host contains a [ or ] that is not a well-formed IPv6 literal before making a host decision. Clients that fail closed on credential-bearing URLs, such as Node's global fetch(), are not affected by the reported vector.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | fast-uri | ≥ 2.4.5&&< 2.4.6 | 2.4.6npm install fast-uri@2.4.6 |
| 📦npm | fast-uri | ≥ 3.1.6&&< 3.1.7 | 3.1.7npm install fast-uri@3.1.7 |
| 📦npm | fast-uri | ≥ 4.1.3&&< 4.1.4 | 4.1.4npm install fast-uri@4.1.4 |
Affected Products
fast-uriopenjsfDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fast-uri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update fast-uri to 2.4.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-58mr-gqgx-xq4g is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exploit URI parsing discrepancies to bypass critical host-level access restrictions, such as SSRF filters or reverse proxy routing, without needing elevated privileges. Within Red Hat environments, the issue…
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Satellite 6.19 for RHEL 9 | foreman-0:3.18.0.14-1.el9sat | RHSA-2026:74503 |
| Cluster Observability Operator 1.5.3 | cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9:1790854494 | RHSA-2026:74609 |
| Network Observability (NETOBSERV) 1.12.3 | network-observability/network-observability-console-plugin-pf5-rhel9:1789978780 | RHSA-2026:70593 |
| Red Hat Ansible Automation Platform 2.1 | ansible-automation-platform/automation-portal:1788775748 | RHSA-2026:65118 |
| Red Hat Ansible Automation Platform 2.2 | ansible-automation-platform/automation-portal:1788783591 | RHSA-2026:65155 |
| Red Hat Ansible Automation Platform 2.2 | ansible-automation-platform/bootc-automation-portal-rhel9:1791865660 | RHSA-2026:82151 |
| Red Hat Ansible Automation Platform 2.6 | ansible-automation-platform-tech-preview/mcp-server-rhel9:1789669036 | RHSA-2026:71179 |
| Red Hat Ansible Automation Platform 2.7 | ansible-automation-platform-27/mcp-server-rhel9:1789518969 | RHSA-2026:71177 |
Frequently Asked Questions
Is GHSA-58mr-gqgx-xq4g in your dependencies?
Find it across npm, including transitive dependencies.