CVE-2026-86472: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.7 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.8 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.5 - Configuration
Compare parsed hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision (workaround when not yet on a fixed fast-uri version).
Application host allowlist/denylist decision logic using fast-uri output host_comparison_case_sensitivity = case-insensitive
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using affected fast-uri versions are exposed only if they make case-sensitive security decisions on parsed hosts, such as host allowlists or denylists, or rely on fast-uri equal for those decisions. The problematic input is particularly relevant for scheme-relative references such as //host.
What does an attacker need to exploit it?
An attacker needs to supply or influence a URI whose host is evaluated by the application’s host-control logic. They can use a percent-encoded uppercase octet, such as %41, to create a host spelling that bypasses a case-sensitive comparison while still resolving to the intended case-insensitive DNS or HTTP hostname.
Are default fast-uri deployments affected?
The parser behavior is present in versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4. Exploitation depends on application-specific case-sensitive host validation; the provided information does not indicate that all uses of fast-uri are exploitable by default.
What can be done if an upgrade cannot be applied immediately?
Lowercase the parsed host before making any host allowlist or denylist decision, so comparisons are case-insensitive. Upgrade when possible to fast-uri 2.4.7, 3.1.8, 4.1.5, or a later version.