EUVD-2026-40093
GHSA-4c8g-83qw-93j6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote, no auth or interaction needed to submit a malicious IDN URL; impact is a security-control bypass (integrity), with no direct confidentiality or availability loss, matching I:H/C:N/A:N.
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.
AnalysisAI
Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remote attackers defeat denylists, loopback filters, redirect validation, and SSRF/proxy-routing controls by supplying Unicode (IDN) hostnames. Because fast-uri's IDN path invokes a non-existent helper on the global URL constructor, it leaves the host in raw Unicode form while normalize() and equal() report a host that differs from what Node's WHATWG URL or fetch ultimately resolve, producing a parser-differential bypass. No public exploit is identified at time of analysis, but the bypass is trivially reproducible and primarily enables SSRF-style integrity attacks.
Technical ContextAI
fast-uri is a fast, RFC 3986 / WHATWG-oriented URI parser for Node.js, widely pulled in transitively (notably by Ajv for the 'uri' format and across the Fastify ecosystem). The flaw is rooted in CWE-436 (Interpretation Conflict): for HTTP-family URLs with internationalized domain names, fast-uri attempts IDN/Punycode canonicalization by calling a helper method that does not actually exist on the global URL constructor. The call silently fails rather than throwing, so the Unicode host is never converted to its ASCII/Punycode canonical form, yet normalize() and equal() continue to return results based on that un-canonicalized host. The CPE cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:* confirms the library itself is the affected component. The core danger is a two-parser disagreement: the application validates a host with fast-uri but issues the actual request with Node's URL/fetch, and the two implementations resolve the same string to two different hosts.
RemediationAI
Upgrade fast-uri to the patched release for your line: Vendor-released patch 3.1.3 for the 3.x line, or 4.0.1 for the 4.x line, per the advisory at https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6. Because fast-uri is frequently a transitive dependency, audit your lockfile and force the resolved version up across nested dependents rather than only your direct dependency. If you cannot patch immediately, two vendor-suggested workarounds apply: enforce host policy using the exact same URL parser (Node's WHATWG URL / fetch) that will issue the real request, eliminating the parser-differential entirely; or reject any URL whose host contains non-ASCII characters before performing policy checks. The trade-off of rejecting non-ASCII hosts is that legitimate internationalized domain names will be refused, which may break valid IDN traffic; the trade-off of unifying on one parser is added refactoring to ensure validation and request paths share identical host resolution.
Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls
Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to
Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today