[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-84394":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":31,"aliases":32,"duplicate_of":9,"upstream":35,"downstream":36,"duplicates":43,"related":44,"reserved_at":9,"published_at":45,"modified_at":46,"state":47,"summary":48,"references_raw":57,"kevs":85,"epss":86,"epss_history":89,"metrics":139,"affected":151},"CVE-2026-84394","fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-436","Interpretation Conflict","Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.","weakness","Incomplete","Class",[19,23,27],{"id":20,"name":21,"techniques":22},"CAPEC-105","HTTP Request Splitting",[],{"id":24,"name":25,"techniques":26},"CAPEC-273","HTTP Response Smuggling",[],{"id":28,"name":29,"techniques":30},"CAPEC-34","HTTP Response Splitting",[],[],[33,34],"UBUNTU-CVE-2026-84394","DEBIAN-CVE-2026-84394",[],[37,39,41],{"_key":38},"RHSA-2026:63782",{"_key":40},"RHSA-2026:65537",{"_key":42},"RHSA-2026:65617",[],[],"2026-09-02T20:25:35.399Z","2026-09-03T13:14:42.123Z","Analyzed",{"cisa_kev":49,"cisa_ransomware":49,"cisa_vendor":9,"epss_severity":50,"epss_score":51,"severity":52,"severity_score":53,"severity_version":54,"severity_source":55,"severity_vector":56,"severity_status":47},false,"low",0.00221,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",[58,67,71,75,79],{"url":59,"sources":60,"tags":63},"https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g",[55,61,62],"nvd","osv_ubuntu",[64,65,66],"Mitigation","Vendor Advisory","REPORT",{"url":68,"sources":69,"tags":70},"https://cna.openjsf.org/security-advisories.html",[55,61,62],[65,66],{"url":72,"sources":73,"tags":74},"https://ubuntu.com/security/CVE-2026-84394",[62],[66],{"url":76,"sources":77,"tags":78},"https://www.cve.org/CVERecord?id=CVE-2026-84394",[62],[66],{"url":80,"sources":81,"tags":83},"https://security-tracker.debian.org/tracker/CVE-2026-84394",[82],"osv_debian",[84],"Advisory",[],{"date":87,"score":51,"percentile":88},"2026-09-19",0.12964,[90,93,96,99,102,105,108,111,114,117,120,123,126,129,132,135,138],{"date":91,"score":51,"percentile":92},"2026-09-03",0.12533,{"date":94,"score":51,"percentile":95},"2026-09-04",0.12547,{"date":97,"score":51,"percentile":98},"2026-09-05",0.12578,{"date":100,"score":51,"percentile":101},"2026-09-06",0.12594,{"date":103,"score":51,"percentile":104},"2026-09-07",0.12589,{"date":106,"score":51,"percentile":107},"2026-09-08",0.12579,{"date":109,"score":51,"percentile":110},"2026-09-09",0.1263,{"date":112,"score":51,"percentile":113},"2026-09-10",0.12622,{"date":115,"score":51,"percentile":116},"2026-09-11",0.12619,{"date":118,"score":51,"percentile":119},"2026-09-12",0.12733,{"date":121,"score":51,"percentile":122},"2026-09-13",0.12688,{"date":124,"score":51,"percentile":125},"2026-09-14",0.12705,{"date":127,"score":51,"percentile":128},"2026-09-15",0.12761,{"date":130,"score":51,"percentile":131},"2026-09-16",0.12804,{"date":133,"score":51,"percentile":134},"2026-09-17",0.12846,{"date":136,"score":51,"percentile":137},"2026-09-18",0.12979,{"date":87,"score":51,"percentile":88},[140,145,147,149],{"source":55,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":141,"cvss_v4_0":9},{"baseScore":53,"baseSeverity":142,"vectorString":56,"impactScore":143,"exploitabilityScore":144},"HIGH",6,10,{"source":61,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":146,"cvss_v4_0":9},{"baseScore":53,"baseSeverity":142,"vectorString":56,"impactScore":143,"exploitabilityScore":144},{"source":62,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":148,"cvss_v4_0":9},{"baseScore":53,"baseSeverity":9,"vectorString":56,"impactScore":143,"exploitabilityScore":144},{"source":82,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":150,"cvss_v4_0":9},{"baseScore":53,"baseSeverity":9,"vectorString":56,"impactScore":143,"exploitabilityScore":144},[152,167,176,193],{"ecosystem":153,"name":154,"vendor":155,"product":154,"cpe_part":9,"purl_type":156,"purl_namespace":155,"purl_name":154,"source":9,"versions":157},"Debian","node-ajv","debian","deb",[158,162,163],{"version":159,"is_range":160,"range_type":161,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":159,"is_range":160,"range_type":161,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":164,"is_range":160,"range_type":161,"version_start":9,"version_start_type":9,"version_end":165,"version_end_type":166,"fixed_in":9},"lt8_20_0~ds+~cs7_1_5_1","8.20.0~ds+~cs7.1.5-1","excluding",{"ecosystem":168,"name":154,"vendor":169,"product":154,"cpe_part":9,"purl_type":156,"purl_namespace":169,"purl_name":154,"source":9,"versions":170},"Ubuntu","ubuntu",[171,172,173,174,175],{"version":159,"is_range":160,"range_type":161,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":159,"is_range":160,"range_type":161,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":159,"is_range":160,"range_type":161,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":159,"is_range":160,"range_type":161,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":159,"is_range":160,"range_type":161,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":177,"vendor":177,"product":177,"cpe_part":178,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":179},"fast-uri","a",[180,185,189],{"version":181,"is_range":160,"range_type":55,"version_start":182,"version_start_type":183,"version_end":184,"version_end_type":166,"fixed_in":9},">= 2.4.5, \u003C 2.4.6","2.4.5","including","2.4.6",{"version":186,"is_range":160,"range_type":55,"version_start":187,"version_start_type":183,"version_end":188,"version_end_type":166,"fixed_in":9},">= 3.1.6, \u003C 3.1.7","3.1.6","3.1.7",{"version":190,"is_range":160,"range_type":55,"version_start":191,"version_start_type":183,"version_end":192,"version_end_type":166,"fixed_in":9},">= 4.1.3, \u003C 4.1.4","4.1.3","4.1.4",{"ecosystem":9,"name":177,"vendor":194,"product":177,"cpe_part":178,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":195},"openjsf",[196,198,199],{"version":182,"is_range":49,"range_type":197,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"cpe",{"version":187,"is_range":49,"range_type":197,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":191,"is_range":49,"range_type":197,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9}]