Detections
Analytics
SCA: security update for fast-uri (GHSA-58mr-gqgx-xq4g)
high Tenable Cloud Security Plugin ID 448446
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an
error. A host that starts with an opening bracket but does not end with a closing bracket is neither
validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with
error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different
host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a
redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its
policy against a string that is not the host the request reaches. The same host is carried through
normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in
2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but
is not a valid IPv6 literal. (CVE-2026-84394)
Solution
Update the fast-uri library and its related packages to version 2.4.6 or later.See Also
Plugin Details
Severity: High
ID: 448446
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 9/29/2026
Updated: 9/29/2026
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.64
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N
CVSS Score Source: CVE-2026-84394
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/28/2026
Vulnerability Publication Date: 9/2/2026
Reference Information
CVE: CVE-2026-84394
cwe: CWE-436