HIGH🇵🇱 Wersja polska

CVE-2026-13676

CVSS 7.5v3.1pub. 2026-06-29upd. 2026-09-04

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • Openjsf Fast Uri

    APP
    Openjsf
    2.3.1 – 3.1.3 (excl.)4.0.0 – 4.0.1 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-84394HIGH7.5same product

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error....

CVE-2026-84292HIGH7.5same product

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the use...

CVE-2026-75931HIGH7.5same product

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an...

CVE-2026-75899HIGH7.5same product

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes...

CVE-2026-75975HIGH7.5same product

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the comp...