fast-uri EUVD-2026-104813

Exploitation requires a consuming application to (1) use fast-uri 2.4.2-2.4.7, 3.1.3-3.1.8, or 4.0.1-4.2.2 on an HTTP-family scheme URL, and (2) enforce a host-based security decision - denylist, loopback/SSRF filtering, redirect allow-listing, or outbound proxy routing - on a host representation that differs from fast-uri's canonicalizeHost() output. The exploitable input is an authority containing more than one at-sign (data before the '@' is silently dropped) or embedded tab, carriage-return, or line-feed characters (silently stripped) with no parse error raised. Limiting factors: the flaw is inert unless the application compares or routes on divergent host representations; impact is confined to misdirected traffic (no code execution or availability loss), and the documented workaround (rejecting multi-at-sign or whitespace authorities, or treating any parse error as fatal) fully mitigates without upgrading.

This is a moderate, conditional risk rather than a top priority. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) correctly reflects a network-reachable, unauthenticated flaw whose severity is tempered by high attack complexity and only low confidentiality/integrity impact. The high complexity is appropriate: exploitation is not inherent to parsing a URI but depends on a consuming application using canonicalizeHost() output to enforce host-based security policy while validating a different representation of the same input. No KEV listing, no EPSS score, and no POC were supplied, so the input signals point to 'no public exploit identified at time of analysis.' No EPSS value is present in the data, so exploitation probability cannot be quantified. The core danger is a parser-differential/SSRF-style policy bypass: it is a potent primitive when fast-uri sits behind denylists, loopback filtering, redirect validators, or proxy routing, but inert in applications that do not make security decisions on the canonicalized host. Net: a legitimate supply-chain concern worth patching promptly in affected deployments, but not an indiscriminate mass-exploitation threat based on available signals.

An application uses fast-uri's canonicalizeHost() to vet an outbound URL or redirect target against a loopback/denylist policy. An attacker supplies an authority containing an extra at-sign or embedded tab/CR/LF (e.g. 'evil.com\t@allowed.internal' style input) so the policy check sees an allowed host while the WHATWG-driven canonicalization silently rewrites it to a different, attacker-chosen destination. No public exploit code was identified, and the attack requires the victim app to enforce host policy on one representation and route on another.