CVE-2026-84394

fast-uri (a URI parsing library used by the Fastify ecosystem) contains a host confusion vulnerability: when a URI's authority contains an opening bracket [ without a matching closing bracket ], parse() returns the string as the host without error. Neither an IP literal nor a valid domain name is...