--- id: CVE-2026-84394 title: >- fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies (CVE-2026-84394) summary: >- A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This hos… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N' cvssSource: vendor cwe: - CWE-1289 - CWE-436 vendor: Red Hat product: Red Hat Satellite 6.19 for RHEL 9 affected: - cost_management_on_premise - multicluster_engine_for_kubernetes - openshift_lightspeed - openshift_pipelines - openshift_serverless - advanced_cluster_management_for_kubernetes 2 - build_of_apache_camel_hawtio 4 - build_of_apicurio_registry 3 - build_of_podman_desktop - connectivity_link 1 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - openshift_data_foundation 4 - openshift_dev_spaces - quay 3 - satellite 6 - secrets_management_console_for_red_hat_openshift - satellite_6_19_for_rhel 9 - cluster_observability_operator 1.5.3 - network_observability_netobserv 1.12.3 - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - developer_hub 1.10 - developer_hub 1.9 - discovery 2 - edge_manager 1.1 - edge_manager 1.2 - hardened_images - migration_toolkit 1.8 - openshift_ai 3.4 - openshift_container_platform 4.18 - openshift_container_platform 4.19 - openshift_container_platform 4.20 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - openshift_dev_spaces 3.30 - quay 3.17 - quay 3.9 patched: - satellite_6_19_for_rhel 9 - cluster_observability_operator 1.5.3 - network_observability_netobserv 1.12.3 - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - developer_hub 1.10 - developer_hub 1.9 - discovery 2 - edge_manager 1.1 - edge_manager 1.2 - hardened_images - migration_toolkit 1.8 - openshift_ai 3.4 - openshift_container_platform 4.18 - openshift_container_platform 4.19 - openshift_container_platform 4.20 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - openshift_dev_spaces 3.30 - quay 3.17 - quay 3.9 - satellite 6.18 - satellite 6.19 published: '2026-09-02' updated: '2026-10-19' sourceUpdated: '2026-10-19T11:29:12+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84394.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84394.json - url: 'https://access.redhat.com/security/cve/CVE-2026-84394' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2527756' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-84394' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84394' - url: 'https://cna.openjsf.org/security-advisories.html' - url: >- https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g - url: 'https://access.redhat.com/errata/RHSA-2026:74503' - url: 'https://access.redhat.com/errata/RHSA-2026:74609' - url: 'https://access.redhat.com/errata/RHSA-2026:70593' - url: 'https://access.redhat.com/errata/RHSA-2026:65118' - url: 'https://access.redhat.com/errata/RHSA-2026:65155' - url: 'https://access.redhat.com/errata/RHSA-2026:82151' - url: 'https://access.redhat.com/errata/RHSA-2026:71179' - url: 'https://access.redhat.com/errata/RHSA-2026:71177' - url: 'https://access.redhat.com/errata/RHSA-2026:76788' - url: 'https://access.redhat.com/errata/RHSA-2026:79088' - url: 'https://access.redhat.com/errata/RHSA-2026:69248' - url: 'https://access.redhat.com/errata/RHSA-2026:69289' - url: 'https://access.redhat.com/errata/RHSA-2026:68044' - url: 'https://access.redhat.com/errata/RHSA-2026:68253' - url: 'https://access.redhat.com/errata/RHSA-2026:68006' - url: 'https://access.redhat.com/errata/RHSA-2026:68254' - url: 'https://access.redhat.com/errata/RHSA-2026:63782' - url: 'https://access.redhat.com/errata/RHSA-2026:65617' - url: 'https://access.redhat.com/errata/RHSA-2026:65537' - url: 'https://access.redhat.com/errata/RHSA-2026:68681' - url: 'https://access.redhat.com/errata/RHSA-2026:84734' - url: 'https://access.redhat.com/errata/RHSA-2026:79040' - url: 'https://access.redhat.com/errata/RHSA-2026:74435' - url: 'https://access.redhat.com/errata/RHSA-2026:68543' - url: 'https://access.redhat.com/errata/RHSA-2026:68547' - url: 'https://access.redhat.com/errata/RHSA-2026:68553' - url: 'https://access.redhat.com/errata/RHSA-2026:68754' - url: 'https://access.redhat.com/errata/RHSA-2026:74511' - url: 'https://access.redhat.com/errata/RHSA-2026:68762' - url: 'https://access.redhat.com/errata/RHSA-2026:68756' - url: 'https://access.redhat.com/errata/RHSA-2026:68748' - url: 'https://access.redhat.com/errata/RHSA-2026:68750' - url: 'https://github.com/fastify/fast-uri/pull/214' - url: >- https://github.com/fastify/fast-uri/commit/e00815236bc94107e44ef1b2f5318a06bac225c0 - url: 'https://github.com/fastify/fast-uri/releases/tag/v2.4.6' - url: 'https://github.com/fastify/fast-uri/releases/tag/v3.1.7' - url: 'https://github.com/fastify/fast-uri/releases/tag/v4.1.4' - url: 'https://github.com/advisories/GHSA-58mr-gqgx-xq4g' tags: - csaf - vex - red-hat - ghsa - npm epss: 0.0038 epssPercentile: 0.31806 aliases: - GHSA-58mr-gqgx-xq4g ecosystem: npm ingestedAt: '2026-09-28T22:22:13.613Z' --- ## Overview A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources. ## Vendor advisories - **RHSA-2026:74503** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74503) - **RHSA-2026:74609** · Red Hat · fixed in: Cluster Observability Operator 1.5.3 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74609) - **RHSA-2026:70593** · Red Hat · fixed in: Network Observability (NETOBSERV) 1.12.3 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70593) - **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118) - **RHSA-2026:65155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65155) - **RHSA-2026:82151** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82151) - **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179) - **RHSA-2026:71177** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71177) - **RHSA-2026:76788** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76788) - **RHSA-2026:79088** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79088) - **RHSA-2026:69248** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69248) - **Red Hat VEX** · Important · affected: Cost Management On Premise, Multicluster Engine for Kubernetes, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Serverless, Red Hat Advanced Cluster Management for Kubernetes 2, … · no fix planned: OpenShift Pipelines, Red Hat Enterprise Linux AI (RHEL AI) 3, Secrets Management Console for Red Hat OpenShift, Cost Management On Premise, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84394.json) - **RHSA-2026:69289** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69289) - **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044) - **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253) - **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006) - **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254) **fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies** — rated Important by Red Hat. Released 2026-09-02, updated 2026-10-19. Affected: - Cost Management On Premise - Multicluster Engine for Kubernetes - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Serverless - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat build of Apache Camel - HawtIO 4 - Red Hat build of Apicurio Registry 3 - Red Hat Build of Podman Desktop - Red Hat Connectivity Link 1 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Openshift Data Foundation 4 - Red Hat OpenShift Dev Spaces - Red Hat Quay 3 - Red Hat Satellite 6 - Secrets Management Console for Red Hat OpenShift Fixed: - Red Hat Satellite 6.19 for RHEL 9 - Cluster Observability Operator 1.5.3 - Network Observability (NETOBSERV) 1.12.3 - Red Hat Ansible Automation Platform 2.1 - Red Hat Ansible Automation Platform 2.2 - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat Developer Hub 1.10 - Red Hat Developer Hub 1.9 - Red Hat Discovery 2 - Red Hat Edge Manager 1.1 - Red Hat Edge Manager 1.2 - Red Hat Hardened Images - Red Hat Migration Toolkit 1.8 - Red Hat OpenShift AI 3.4 - Red Hat OpenShift Container Platform 4.18 - Red Hat OpenShift Container Platform 4.19 - Red Hat OpenShift Container Platform 4.20 - Red Hat OpenShift Container Platform 4.21 - Red Hat OpenShift Container Platform 4.22 - Red Hat OpenShift Dev Spaces 3.30 - Red Hat Quay 3.17 - Red Hat Quay 3.9 - Red Hat Satellite 6.18 - Red Hat Satellite 6.19 No fix planned: - OpenShift Pipelines - Red Hat Enterprise Linux AI (RHEL AI) 3 - Secrets Management Console for Red Hat OpenShift - Cost Management On Premise - Multicluster Engine for Kubernetes - OpenShift Lightspeed - OpenShift Serverless - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat build of Apache Camel - HawtIO 4 - Red Hat build of Apicurio Registry 3 - Red Hat Build of Podman Desktop - Red Hat Connectivity Link 1 - Red Hat OpenShift AI (RHOAI) - Red Hat Openshift Data Foundation 4 - Red Hat OpenShift Dev Spaces - Red Hat Quay 3 - Red Hat Satellite 6 Not affected: - Red Hat Satellite 6.19 for RHEL 9 - Cluster Observability Operator 1.5.3 - Network Observability (NETOBSERV) 1.12.3 - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat Developer Hub 1.10 - Red Hat Developer Hub 1.9 - Red Hat Discovery 2 - Red Hat Edge Manager 1.1 - Red Hat Edge Manager 1.2 ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:74503 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:74609 For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:70593 ## Package advisory (CVE-2026-84394) Affected packages: - `fast-uri = 2.4.5` - `fast-uri = 3.1.6` - `fast-uri = 4.1.3` Patched in: - `fast-uri 2.4.6` - `fast-uri 3.1.7` - `fast-uri 4.1.4` Source: https://github.com/advisories/GHSA-58mr-gqgx-xq4g