Skip to content
Log inStart free trial

GHSA-4c8g-83qw-93j6 CVE-2026-13676

fast-uri vulnerable to host confusion via failed IDN canonicalization

High npm
Severity
7.5 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.69%
Chance of exploitation in the next 30 days. Higher than 52.91% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-436 Interpretation Conflict
CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Fix
4.0.1
Upgrade fast-uri to this version or later

Description

Impact

fast-uri versions >= 2.3.1, <= 4.0.0 fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls URL.domainToASCII(...) on the global WHATWG URL constructor, where that helper does not exist. The resulting TypeError is silently routed into parsed.error, but parse(), normalize(), and equal() all return with the host left in its original Unicode form.

For example, http://127。0。0。1/ is treated by fast-uri as host 127。0。0。1, while Node's WHATWG URL parser and fetch() canonicalize the same input to 127.0.0.1.

Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination.

Patches

Upgrade to fast-uri v4.0.1, v3.1.3, or v2.4.2

Workarounds

None. Upgrade to the patched version.

Affected versions

npm

PackageVulnerableFixed in
fast-uri
>= 4.0.0, < 4.0.1
4.0.1
fast-uri
>= 3.0.0, < 3.1.3
3.1.3
fast-uri
>= 2.3.1, < 2.4.2
2.4.2
fast-uri
>= 4.0.0, < 4.0.1
4.0.1
fast-uri
>= 3.0.0, < 3.1.3
3.1.3
fast-uri
>= 2.3.1, < 2.4.2
2.4.2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

fast-uri npm → 4.0.1

npm
npm install fast-uri@4.0.1
yarn
yarn add fast-uri@4.0.1
pnpm
pnpm add fast-uri@4.0.1

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Weakness

CWE-436: Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

How to prevent it
  • Architecture and Design: URL Inputs should be decoded and canonicalized to the application's current internal representation before being validated and processed for authorization. Make sure that your application does not decode the same input twice. Such errors could be used to bypass allowlist schemes by introducing dangerous inputs after they have been checked.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-333x-w4r6-6crp
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
Low Also affects fast-uri
GHSA-w74x-v6f9-j3xg
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
Medium Also affects fast-uri
GHSA-wjr9-j795-jxcr
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
Medium Also affects fast-uri
GHSA-xhq7-xmqj-769h
fast-uri vulnerable to improper path equivalence in relative reference normalization
Low Also affects fast-uri
GHSA-jvvf-x445-j334
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Medium Also affects fast-uri
GHSA-hrr3-gc8f-f4qj
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
Medium Also affects fast-uri
GHSA-58mr-gqgx-xq4g
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
High Also affects fast-uri
GHSA-qw65-cvwx-89v3
fast-uri vulnerable to authority injection via an unvalidated port in serialize
High Also affects fast-uri

Credits: UlisesGascon, celinke97

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor