chore(repo): Update dependency fast-uri@<3.1.6 to v3.1.7 [SECURITY] by renovate[bot] · Pull Request #10056 · clerk/javascript

renovate · 2026-10-03T23:09:38Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
fast-uri@<3.1.6	`3.1.6` → `3.1.7`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

CVE-2026-84394 / GHSA-58mr-gqgx-xq4g

More information

Details

Impact

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket ([ or ]) without reporting an error. A host that starts with [ but does not end with ], such as [@127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL (and http.get, axios, got, and other clients built on it) resolve the same string to 127.0.0.1. An application that reads parse().host to make a host decision (an SSRF denylist, a redirect allowlist, or proxy routing) and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize(), equal(), and resolve().

Patches

This vulnerability has been patched in fast-uri 4.1.4, 3.1.7, and 2.4.6. parse() now reports URI host is malformed. for any host that contains a bracket but is not a valid [IPv6] literal. All users should upgrade.

Workarounds

If upgrading is not immediately possible, reject any URL whose host contains a [ or ] that is not a well-formed IPv6 literal before making a host decision. Clients that fail closed on credential-bearing URLs, such as Node's global fetch(), are not affected by the reported vector.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

fast-uri vulnerable to authority injection via an unvalidated port in serialize

CVE-2026-84292 / GHSA-qw65-cvwx-89v3

More information

Details

Impact

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose port is @127.0.0.1:8124 produces http://trusted.example:@127.0.0.1:8124/app, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it.

This affects applications that build URIs from parts and assign untrusted data to the port component (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable through serialize(), normalize(), and equal() in their object forms. A port obtained from parse() is always digits and is not affected.

Patches

This vulnerability has been patched in fast-uri 4.1.4, 3.1.7, and 2.4.6. recomposeAuthority now rejects any port that is not *DIGIT per RFC 3986. All users should upgrade.

Workarounds

If upgrading is not immediately possible, validate the port value against the RFC 3986 grammar (digits only) before passing a component to serialize(), normalize(), or equal(), and reject anything else, for example if (!/^\d*$/.test(String(port))) throw new Error('invalid port').

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

fastify/fast-uri (fast-uri@<3.1.6)

`v3.1.7`

Compare Source

Configuration

📅 Schedule: (in timezone GMT)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-10-03T23:09:41Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 3, 2026 11:12pm UTC
swingset	Ready	Preview	Oct 3, 2026 11:12pm UTC

changeset-bot · 2026-10-03T23:09:42Z

⚠️ No Changeset found

Latest commit: 5c3c6e8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-10-03T23:09:52Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 40f6a46c-8f0f-41d2-9cd8-6fbd2d59df5b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

pkg-pr-new · 2026-10-03T23:12:37Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10056

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10056

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10056

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10056

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10056

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10056

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10056

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10056

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10056

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10056

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10056

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10056

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10056

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10056

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10056

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10056

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10056

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10056

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10056

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10056

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10056

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10056

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10056

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10056

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10056

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10056

commit: 5c3c6e8

chore(repo): Update dependency fast-uri@<3.1.6 to v3.1.7 [SECURITY]

5c3c6e8

renovate Bot added the dependencies Pull requests that update a dependency file label Oct 3, 2026

vercel Bot deployed to Preview – clerk-js-sandbox October 3, 2026 23:10 View deployment

vercel Bot deployed to Preview – swingset October 3, 2026 23:12 View deployment

Navigation Menu

chore(repo): Update dependency fast-uri@<3.1.6 to v3.1.7 [SECURITY] - #10056

chore(repo): Update dependency fast-uri@<3.1.6 to v3.1.7 [SECURITY]#10056
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-fast-uri-3.1.6-vulnerability

renovate Bot commented Oct 3, 2026

Uh oh!

vercel Bot commented Oct 3, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 3, 2026

Uh oh!

coderabbitai Bot commented Oct 3, 2026

Review skipped

Uh oh!

pkg-pr-new Bot commented Oct 3, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 3, 2026

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

Details

Impact

Patches

Workarounds

Severity

References

fast-uri vulnerable to authority injection via an unvalidated port in serialize

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

v3.1.7

Configuration

Uh oh!

vercel Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Oct 3, 2026

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Oct 3, 2026

Review skipped

Uh oh!

pkg-pr-new Bot commented Oct 3, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v3.1.7`

vercel Bot commented Oct 3, 2026 •

edited

Loading