GHSA-5jgf-p345-68v8: High severity npm/fast-uri vulnerability
Impact
fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve() resolves a scheme-relative reference (//host/) against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved URI yields a different host than the one resolve() returned. An application that resolves an untrusted reference with fast-uri and then checks or routes on the resulting host can make a policy decision on one host and reach another. This is an incomplete-fix variant of CVE-2026-13676, whose IDN canonicalization was applied only to the scheme-bearing form.
Patches
Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. resolve() now canonicalizes the host once the effective scheme is known, and fails closed if a raw non-ASCII host cannot be converted.
Workarounds
Resolve scheme-relative references against a base that carries a scheme before performing any host-policy or origin check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Configuration
In applications using fast-uri, ensure you resolve any scheme-relative reference against a scheme-bearing base before doing host-policy/origin checks or routing decisions.
fast-uri resolve() scheme-relative reference handling = Resolve scheme-relative references (`//host/`) against a base that includes a scheme before performing host-policy or origin checks/routes
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they use fast-uri to resolve untrusted scheme-relative references such as //host/ against a scheme-bearing base, then make host-policy, origin, routing, or similar security decisions using the resolved host.
What does an attacker need to exploit it?
An attacker needs to supply a scheme-relative URI reference containing a host whose verbatim representation differs from its ASCII-canonicalized form when reparsed. No authentication or user interaction is required according to the provided severity vector.
Are patched releases available?
Yes. Upgrade fast-uri to version 2.4.5, 3.1.6, or 4.1.3. The fix canonicalizes the host after the effective scheme is known and fails closed when a raw non-ASCII host cannot be converted.
What can be done if upgrading is not immediately possible?
Resolve scheme-relative references against a base URI that carries a scheme before performing any host-policy or origin check.