GHSA-jqff-g426-hqxp CVE-2026-76172
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.23%
- Chance of exploitation in the next 30 days. Higher than 14.14% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-177 Improper Handling of URL Encoding (Hex Encoding)
- Fix
2.4.5- Upgrade fast-uri to this version or later
Description
Impact
fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape() and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore introduce structure the original input did not contain.
For example, %2f%2fevil.example:/pwn parses with no authority (parse().host is undefined), but resolve() and normalize() return //evil.example:/pwn, which reparses with host evil.example. The %uXXXX form (%u002f%u002fevil.example:/pwn) produces the same result, and a scheme containing %0d%0a reaches the output as a raw CR LF.
Applications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision, especially ones that treat a missing authority as same-origin, can be steered to an attacker-chosen authority, and a normalized URI placed in a response header can carry an injected CR LF.
Patches
Upgrade to fast-uri >= 4.1.3, or >= 3.1.6 in the v3.x release line, or >= 2.4.5 in the v2.x release line.
Workarounds
None. Upgrade to the patched version.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| fast-uri | >= 2.3.1, < 2.4.5 |
2.4.5 |
| fast-uri | >= 3.0.0, < 3.1.6 |
3.1.6 |
| fast-uri | >= 4.0.0, < 4.1.3 |
4.1.3 |
| fast-uri | >= 2.3.1, < 2.4.5 |
2.4.5 |
| fast-uri | >= 3.0.0, < 3.1.6 |
3.1.6 |
| fast-uri | >= 4.0.0, < 4.1.3 |
4.1.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
fast-uri npm → 2.4.5
- npm
npm install fast-uri@2.4.5- yarn
yarn add fast-uri@2.4.5- pnpm
pnpm add fast-uri@2.4.5
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-177: Improper Handling of URL Encoding (Hex Encoding)
The product does not properly handle when all or part of an input has been URL encoded.
How to prevent it
- Architecture and Design: Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references | Low | Also affects fast-uri |
| GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding | Medium | Also affects fast-uri |
| GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization | Medium | Also affects fast-uri |
| GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization | Low | Also affects fast-uri |
| GHSA-jvvf-x445-j334 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization | Medium | Also affects fast-uri |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets | Medium | Also affects fast-uri |
| GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority | High | Also affects fast-uri |
| GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize | High | Also affects fast-uri |
Credits: UlisesGascon, YashvantHange, mcollina
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor