EUVD-2026-27248
GHSA-v39h-62p7-jpjc
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2Blast Radius
ecosystem impact- 198,388 npm packages depend on fast-uri (2,437 direct, 195,978 indirect)
Ecosystem-wide dependent count for version 3.1.2.
DescriptionNVD
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.
AnalysisAI
Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. The normalize() function improperly decodes percent-encoded at-signs (%40) in hostnames, then re-serializes them as raw userinfo delimiters, causing URLs like 'http://trusted.com%40evil.com' to resolve to 'evil.com' instead of 'trusted.com'. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all applications and services using fast-uri library and document current versions in use. Within 7 days: Upgrade fast-uri to version 3.1.2 or later across all production systems; verify through dependency scanning tools (npm audit, Snyk, etc.). …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today