CVE-2026-75931: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Impact
fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve() resolves a scheme-relative reference (//host/) against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved URI yields a different host than the one resolve() returned. An application that resolves an untrusted reference with fast-uri and then checks or routes on the resulting host can make a policy decision on one host and reach another. This is an incomplete-fix variant of CVE-2026-13676, whose IDN canonicalization was applied only to the scheme-bearing form.
Patches
Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. resolve() now canonicalizes the host once the effective scheme is known, and fails closed if a raw non-ASCII host cannot be converted.
Workarounds
Resolve scheme-relative references against a base that carries a scheme before performing any host-policy or origin check.
Other sources
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a patched version.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Compensating control
Resolve scheme-relative references (e.g., starting with “//host/”) against a base that carries a scheme before performing any host-policy or origin check, to avoid host-confusion/policy bypass.
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using npm/fast-uri versions 2.4.2 through 2.4.4, 3.1.3 through 3.1.5, or 4.0.1 through 4.1.2 are affected. The issue is fixed in versions 2.4.5, 3.1.6, and 4.1.3.
What application behavior makes this vulnerability exploitable?
An application is exposed when it uses fast-uri to extract a host for comparison against a policy or allowlist and then resolves the same scheme-relative reference. The host used for the policy decision can differ from the resolved destination because scheme-relative references skip IDN canonicalization.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required.
What should teams do if they cannot immediately upgrade?
The provided remediation is to upgrade to a patched fast-uri release. No temporary mitigation or configuration workaround is specified in the available data.
How can teams determine whether they are at risk?
Check the installed fast-uri version and identify code paths that validate hosts with fast-uri before resolving scheme-relative references. In affected versions, parse, resolve, normalize, and equal may produce inconsistent host handling for inputs beginning with two slashes.