The popular fast-uri parsing library, tracked as CVE-2026-84394, fails to flag URLs whose host contains a stray or unmatched bracket character. Because fast-uri's parser and Node's own URL resolver can disagree about what host such a malformed string actually points to, an application that trusts fast-uri's parsed host for access-control decisions could be tricked into contacting a different server than intended, a classic setup for server-side request forgery.
// source: nvd.nist.gov ↗