Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-13676

fast-uri vulnerable to host confusion via failed IDN canonicalization

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
openjs

Description

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

fast-uri fast-uri

Default version status: unaffected

  • 4.0.0 to < 4.0.1affected
  • 4.0.1unaffected
  • 2.3.1 to < 3.1.3affected
  • 3.1.3unaffected
pkg:npm/fast-uri

References