EUVD-2026-40093
GHSA-4c8g-83qw-93j6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify endpoint that validates URL host via fast-uri
-
DeliveryCraft URL with Unicode/IDN hostname
-
Exploitfast-uri leaves host un-canonicalized and passes policy check
-
ExecutionNode URL/fetch resolves host to internal target
-
ImpactServer issues request to attacker-chosen host (SSRF/policy bypass)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
| Exploitation Conditions | Exploitation requires that the target application use fast-uri (vulnerable versions 2.3.1-3.1.2 or 4.0.0) to make a host-based security decision - denylist/allowlist checks, loopback/internal filtering, redirect destination validation, or outbound proxy routing - and then perform the actual HTTP request with a different, WHATWG-compatible parser such as Node's URL or fetch. The malicious input must be an HTTP-family URL carrying a Unicode/IDN hostname, since the broken canonicalization path is specific to IDN conversion. Limiting factors: if the application validates and requests with the same parser, or never uses fast-uri for host enforcement, or rejects non-ASCII hosts, the bypass does not apply. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the vulnerability has no effect unless the vulnerable validate-with-one-parser/request-with-another pattern is present in the deployment. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N scores 7.5 and is internally consistent for this class: network-reachable, low complexity, no privileges, no user interaction, with a pure integrity impact (security-control bypass) and no direct confidentiality or availability loss. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed active exploitation. No EPSS score or SSVC decision data was provided, so probabilistic exploitation signals cannot be incorporated. The real-world risk is conditional rather than universal: it only matters where fast-uri is used to enforce host-based policy ahead of a request made by a different parser. Where that pattern exists (SSRF defenses, redirect allowlists, outbound proxy routing), the impact can be significant despite the I:H/C:N profile, because a bypassed SSRF filter can lead to access of internal services. Treat as a meaningful priority for applications relying on fast-uri for security decisions, and lower priority where fast-uri is only a transitive validation dependency not used for host enforcement. |
| Exploit ScenarioDerived | An application uses fast-uri to validate that a user-supplied webhook or redirect URL does not point at internal/loopback hosts, then fetches the URL with Node's fetch. An attacker submits a URL whose host is an internationalized (Unicode) form that fast-uri leaves un-canonicalized and judges allowed, but which Node's URL parser canonicalizes to an internal target, sending the server's request to an attacker-chosen internal host (SSRF). No exploit code is currently public, and the network attack vector with low complexity and no authentication makes the bypass straightforward to attempt. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 29, 2026
Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remote attackers defeat denylists, loopback filters, redirect validation, and SSRF/proxy-routing controls by supplying Unicode (IDN) hostnames. Because fast-uri's IDN path invokes a non-existent helper on the global URL constructor, it leaves the host in raw Unicode form while normalize() and equal() report a host that differs from what Node's WHATWG URL or fetch ultimately resolve, producing a parser-differential bypass. No public exploit is identified at time of analysis, but the bypass is trivially reproducible and primarily enables SSRF-style integrity attacks.
RemediationAI
Upgrade fast-uri to the patched release for your line: Vendor-released patch 3.1.3 for the 3.x line, or 4.0.1 for the 4.x line, per the advisory at https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6. Because fast-uri is frequently a transitive dependency, audit your lockfile and force the resolved version up across nested dependents rather than only your direct dependency. If you cannot patch immediately, two vendor-suggested workarounds apply: enforce host policy using the exact same URL parser (Node's WHATWG URL / fetch) that will issue the real request, eliminating the parser-differential entirely; or reject any URL whose host contains non-ASCII characters before performing policy checks. The trade-off of rejecting non-ASCII hosts is that legitimate internationalized domain names will be refused, which may break valid IDN traffic; the trade-off of unifying on one parser is added refactoring to ensure validation and request paths share identical host resolution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
fast-uri is a fast, RFC 3986 / WHATWG-oriented URI parser for Node.js, widely pulled in transitively (notably by Ajv for the 'uri' format and across the Fastify ecosystem). The flaw is rooted in CWE-436 (Interpretation Conflict): for HTTP-family URLs with internationalized domain names, fast-uri attempts IDN/Punycode canonicalization by calling a helper method that does not actually exist on the global URL constructor. The call silently fails rather than throwing, so the Unicode host is never converted to its ASCII/Punycode canonical form, yet normalize() and equal() continue to return results based on that un-canonicalized host. The CPE cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:* confirms the library itself is the affected component. The core danger is a two-parser disagreement: the application validates a host with fast-uri but issues the actual request with Node's URL/fetch, and the two implementations resolve the same string to two different hosts.
Know when Fast Uri gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote, no auth or interaction needed to submit a malicious IDN URL; impact is a security-control bypass (integrity), with no direct confidentiality or availability loss, matching I:H/C:N/A:N.
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
1DescriptionCVE.org
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.
Executive ViewAI
The fast-uri Node.js parser (versions 2.3.1-3.1.2, 4.0.0) contains a security bypass that allows remote attackers to circumvent SSRF protections, loopback filters, and redirect validation through Unicode hostname encoding. Applications relying on this library to enforce URL security policies face elevated risk of unauthorized internal network access, server-side request forgery, and lateral movement to backend systems. Organizations must immediately inventory affected applications and implement compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network inspection to detect and block Unicode-encoded hostnames in requests; (2) Add application-layer hostname normalization and re-validation before backend routing; (3) Apply firewall rules restricting application-to-internal-service connections; (4) Evaluate replacement URI parsing libraries; (5) Enable request/response logging and alerting for suspicious encoding patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify eco
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ
URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to
Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls
Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T
Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy ro
Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the res
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
Exploit-DB