fast-uri versions prior to 4.1.4, 3.1.7, and 2.4.6 accept URI hosts containing unbalanced or misplaced brackets (e.g., a host starting with '[' but missing a closing ']'). Such hosts are neither validated as IP literals nor canonicalized as domain names, causing parse() to return the malformed host without error. Meanwhile, Node.js URL clients resolve the same host string differently, potentially to a valid IP address like 127.0.0.1. This mismatch can lead to security bypasses in applications that use fast-uri's parse().host for host-based security policies but pass the original URL to HTTP clients. The vulnerability is identified as CVE-2026-84394 and has a CVSS 3.1 score of 7.5 (high severity).

Applications using fast-uri versions before the patched releases may incorrectly trust the host value returned by parse().host when making security decisions such as SSRF denylisting, redirect allowlisting, or proxy routing. Because the host string is not validated or canonicalized properly, an attacker can craft URLs with unclosed brackets that bypass these checks, while the actual HTTP client resolves the host differently, potentially reaching unintended destinations. This can lead to security policy bypass and potential information disclosure or unauthorized access.

A patch is available and should be applied by upgrading fast-uri to versions 4.1.4, 3.1.7, or 2.4.6. The patch causes parse() to report an error for malformed hosts containing brackets that are not valid IPv6 literals. If immediate upgrade is not possible, applications should reject any URL whose host contains '[' or ']' that is not a well-formed IPv6 literal before making host-based security decisions. Note that clients that fail closed on credential-bearing URLs, such as Node's global fetch(), are not affected by this vulnerability.