CVE-2026-84394

What it actually does

fast-uri parse() accepts a host that contains an unbalanced or misplaced authority bracket and returns it with error undefined. The value is neither validated as an IPv6 literal nor canonicalized as a domain name, so the parsed host is not the host that Node.js URL and HTTP clients built on it will contact. The same non-canonical host is preserved through normalize, equal, and resolve, so host-based policy (SSRF denylists, redirect allowlists, proxy routing) can be evaluated against a string that is not the destination of the subsequent request. Integrity of URL identity is lost; confidentiality and availability of the parser itself are not directly affected.

Why it matters to the business

Services that decide where a request may go by inspecting a parsed host, then fetch the original URL, can be steered to an unintended destination. That can bypass SSRF and redirect controls, expose internal-only endpoints, or mis-route proxy traffic. The library is embedded across a wide Red Hat product set (Ansible Automation Platform, Grafana, OpenShift console plugins, Satellite Insights, Developer Hub, Flight Control, Network Observability, and related images), so a single parser bug has broad operational blast radius in automation, observability, and platform consoles. The issue is not in CISA KEV, is not associated with ransomware, and has no public exploit maturity, but it has been public for about a month with CVSS 7.5 (high integrity, network, unauthenticated), so unpatched URL-processing and internet-facing consoles remain a material control-bypass risk.

How an attack unfolds

An unauthenticated attacker supplies a URL whose authority contains an opening bracket that is not part of a valid IPv6 literal (unbalanced or misplaced). The application parses that URL with a vulnerable fast-uri build; parse() treats the malformed string as the host and reports no error. Host-based policy therefore allows, denies, or routes based on a host that will never be contacted. The application then passes the original URL to Node's URL/HTTP stack, which resolves a different host and issues the request there. Because normalize, equal, and resolve carry the same malformed host, later comparisons do not reconcile the two interpretations. No named APT groups or ransomware campaigns are reported for this CVE; abuse is most likely opportunistic against applications that split parse-time policy from fetch-time URL handling.

How to fix it

Upgrade the fast-uri library to 2.4.6 (from 2.4.5), 3.1.7 (from 3.1.6), or 4.1.4 (from 4.1.3). Patched parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal. For Red Hat-shipped products, apply RHSA-2026:71177: ansible-automation platform/automation-portal:1788783591; ansible-automation-platform-27/mcp and ansible-automation-platform-tech-preview/mcp server-rhel9 builds 1789518969 and 1789669036; discovery ui-rhel9:1789677459; grafana12-4-main 12.4.9-0.6.hum1, grafana13-1-main 13.1.3-0.6.hum1, grafana13-2-main 13.2.1-0.2.hum1; network-observability console plugin-rhel9:1789978277 and console-plugin pf5-rhel9:1789978780; openshift4/nmstate-console plugin-rhel9:1789517682; rhdh hub-rhel9:1789554285; rhem/flightctl ui-rhel10:1789488111 and flightctl-ui ocp-rhel9:1789486476; rhmtc/openshift-migration ui-rhel8:1789546373; satellite/iop remediations-rhel9:1789615593, iop-advisor frontend-rhel9:1789659565, and iop-host-inventory frontend-rhel9:1789613107. Rebuild and redeploy any private images that vendor fast-uri. Do not treat a second parser as a workaround unless the identical string is used for both policy and the outbound request.

How to confirm the fix worked

Confirm installed fast-uri is 2.4.6, 3.1.7, or 4.1.4 (or later on that line), and that Red Hat images match the RHSA-2026:71177 builds above. After upgrade, parse() must flag any host that contains a bracket but is not a valid IPv6 literal as malformed rather than returning it with error undefined. Review code and config that feed parse()/normalize/equal/resolve results into denylists, allowlists, or routing and then pass the original URL to an HTTP client. In staging, submit URLs with bracketed hosts that are not valid IPv6 literals and verify policy and the client now fail closed on the same input. Inventory npm/yarn/pnpm lockfiles and container SBOMs for fast-uri 2.4.5, 3.1.6, and 4.1.3.

Typical attack path

1. Locate an application or product that parses user-controlled URLs with fast-uri (or an embedded copy) and later issues HTTP requests using the original URL string.
2. Submit a URL whose host contains an unbalanced or misplaced authority bracket so it is not a valid IPv6 literal.
3. Cause host-based policy (SSRF denylist, redirect allowlist, or proxy routing) to run against the uncanonicalized parse() host, which reports no error.
4. Trigger the application to pass the original URL to a Node.js URL/HTTP client that resolves a different host.
5. Reach an unintended internal, restricted, or off-allowlist destination, or complete a redirect/proxy that policy was meant to block.

How to detect it

There is no public exploit kit or named-actor TTP set. Hunt application, access, and egress logs for user-supplied URLs whose host/authority contains '[' or ']' but is not a valid IPv6 literal, especially where the app accepted the URL (no parse error) and later made an outbound request. Compare policy-decision logs (parsed host) with the host or IP actually connected by the Node HTTP client; a mismatch is the core artifact. Review reverse-proxy and service-mesh logs for unusual Host headers or request-targets with unmatched brackets. Check application debug/audit logs for fast-uri parse results that include a bracketed host and an undefined/empty error on vulnerable versions. Look for sudden application egress to internal-only or off-allowlist addresses following URL submissions. Correlate with package/image versions 2.4.5, 3.1.6, or 4.1.3 still running at the time of the request.

• fast-uri@2.4.5
• fast-uri@3.1.6
• fast-uri@4.1.3
• host starting with '[' without a closing ']'
• URL authority containing '[' that is not a valid IPv6 literal
• parse() host with '[' and error undefined
• HTTP request-target or Host header with unmatched '[' or ']'
• Node.js HTTP client connect host differs from fast-uri parsed host
• outbound request after accepted URL containing misplaced authority bracket

What your security team should do

• Patch fast-uri to 2.4.6 / 3.1.7 / 4.1.4 and apply RHSA-2026:71177 across Ansible Automation, Grafana, OpenShift console plugins, Satellite, Developer Hub, Flight Control, Discovery, and Network Observability images without waiting for KEV listing.
• Inventory lockfiles, container SBOMs, and vendor images for fast-uri 2.4.5, 3.1.6, and 4.1.3, including transitive copies in UI and MCP containers.
• Identify application paths that parse a URL for host policy and then fetch the original string; fail closed on parse errors and use one canonicalization for both decision and request.
• Prioritize internet-facing consoles, redirectors, webhooks, and proxy/routing features that accept user-controlled URLs.
• Until patched, restrict egress from those services to known-good destinations and monitor for user-supplied URLs whose host contains brackets that are not valid IPv6 literals.
• Track this as a high-integrity SSRF-class parser mismatch (CVSS 7.5, public ~31 days, exploit maturity none); re-evaluate if exploit code or KEV listing appears.