GHSA-5jgf-p345-68v8 CVE-2026-75931
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.40%
- Chance of exploitation in the next 30 days. Higher than 34.04% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-436 Interpretation Conflict
- Fix
2.4.5- Upgrade fast-uri to this version or later
Description
Impact
fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve() resolves a scheme-relative reference (//host/) against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved URI yields a different host than the one resolve() returned. An application that resolves an untrusted reference with fast-uri and then checks or routes on the resulting host can make a policy decision on one host and reach another. This is an incomplete-fix variant of CVE-2026-13676, whose IDN canonicalization was applied only to the scheme-bearing form.
Patches
Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. resolve() now canonicalizes the host once the effective scheme is known, and fails closed if a raw non-ASCII host cannot be converted.
Workarounds
Resolve scheme-relative references against a base that carries a scheme before performing any host-policy or origin check.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| fast-uri | >= 2.4.2, < 2.4.5 |
2.4.5 |
| fast-uri | >= 3.1.3, < 3.1.6 |
3.1.6 |
| fast-uri | >= 4.0.1, < 4.1.3 |
4.1.3 |
| fast-uri | >= 2.4.2, < 2.4.5 |
2.4.5 |
| fast-uri | >= 3.1.3, < 3.1.6 |
3.1.6 |
| fast-uri | >= 4.0.1, < 4.1.3 |
4.1.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
fast-uri npm → 2.4.5
- npm
npm install fast-uri@2.4.5- yarn
yarn add fast-uri@2.4.5- pnpm
pnpm add fast-uri@2.4.5
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references | Low | Also affects fast-uri |
| GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding | Medium | Also affects fast-uri |
| GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization | Medium | Also affects fast-uri |
| GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization | Low | Also affects fast-uri |
| GHSA-jvvf-x445-j334 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization | Medium | Also affects fast-uri |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets | Medium | Also affects fast-uri |
| GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority | High | Also affects fast-uri |
| GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize | High | Also affects fast-uri |
Credits: UlisesGascon, baeseungwon1010, mcollina
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor