CVE-2026-76172: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Impact
fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape() and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore introduce structure the original input did not contain.
For example, %2f%2fevil.example:/pwn parses with no authority (parse().host is undefined), but resolve() and normalize() return //evil.example:/pwn, which reparses with host evil.example. The %uXXXX form (%u002f%u002fevil.example:/pwn) produces the same result, and a scheme containing %0d%0a reaches the output as a raw CR LF.
Applications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision, especially ones that treat a missing authority as same-origin, can be steered to an attacker-chosen authority, and a normalized URI placed in a response header can carry an injected CR LF.
Patches
Upgrade to fast-uri >= 4.1.3, or >= 3.1.6 in the v3.x release line, or >= 2.4.5 in the v2.x release line.
Workarounds
None. Upgrade to the patched version.
Other sources
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.5
Event History
Frequently Asked Questions
Which releases need to be updated?
Affected releases are fast-uri 2.3.1 before 2.4.5, 3.0.0 before 3.1.6, and 4.0.0 before 4.1.3. Fixed releases are 2.4.5, 3.1.6, and 4.1.3.
What application behavior makes exploitation realistic?
An attacker needs to supply a URI that the application parses with fast-uri and then resolves or normalizes. Applications are exposed when they allowlist based on the initially parsed host or treat a reference without an authority as safe to resolve against a base URI.
What outcomes should be investigated in affected applications?
The inconsistency can cause an attacker-chosen authority to appear after resolution or normalization, enabling off-site redirects, server-side request forgery, or address-policy bypasses. The legacy decoder can also accept non-standard escape forms that may pass upstream filters, and raw carriage return and line feed can reach serialized output.