GHSA-v39h-62p7-jpjc CVE-2026-6322

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

High npm

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.51%; Chance of exploitation in the next 30 days. Higher than 43.68% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-140 Improper Neutralization of Delimiters; CWE-436 Interpretation Conflict
Fix: 3.1.2; Upgrade fast-uri to this version or later

Description

Impact

fast-uri v3.1.1 and earlier decodes percent-encoded authority delimiters (%40 as @, %3A as :) inside the host component and serializes them back as raw characters. This changes the URI structure, turning a hostname into userinfo plus a different host.

For example, http://trusted.com%40evil.com/ normalizes to http://trusted.com@evil.com/, which reparses as host evil.com with userinfo trusted.com.

Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the original URL appeared to contain.

Patches

Upgrade to fast-uri >= 3.1.2, or if you are in the v2.x release line, v2.4.1

Workarounds

None. Upgrade to the patched version.

Affected versions

npm

Package	Vulnerable	Fixed in
fast-uri	`>= 3.0.0, <= 3.1.1`	No fix yet
fast-uri	`<= 2.4.0`	No fix yet
fast-uri	`>= 3.0.0, < 3.1.2`	`3.1.2`
fast-uri	`< 2.4.1`	`2.4.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

fast-uri npm → `3.1.2`

npm

npm install fast-uri@3.1.2

yarn

yarn add fast-uri@3.1.2

pnpm

pnpm add fast-uri@3.1.2

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Weakness

CWE-140: Improper Neutralization of Delimiters

The product does not neutralize or incorrectly neutralizes delimiters.

How to prevent it

Implementation: Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Implementation: While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).
Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

CWE-436: Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

References

Advisories

Packages

github.com/fastify/fast-uri

Timeline

May 5, 2026 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references	Low	Also affects fast-uri
GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding	Medium	Also affects fast-uri
GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization	Medium	Also affects fast-uri
GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization	Low	Also affects fast-uri
GHSA-jvvf-x445-j334 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization	Medium	Also affects fast-uri
GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets	Medium	Also affects fast-uri
GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority	High	Also affects fast-uri
GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize	High	Also affects fast-uri

Credits: Jvr2022, UlisesGascon, climba03003, jlang-ih, mcollina, zakaryan2004

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor