GHSA-f65p-4m7j-42xc: Input Validation

Published Sep 2, 2026
·
Updated

Impact

fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize('http://[::not-valid]/private') returns http://[::]/private, and [fc00::not-hex] and [fe80::not-hex] collapse to [fc00::] and [fe80::]. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (::1), unique-local, or link-local. Because parse().error is unset for these inputs, checking it does not protect the consumer.

Patches

Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. Malformed IPv6 literals are now rejected with a host error instead of being normalized to a valid address.

Workarounds

Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri, or route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.

Affected Software

3 affected componentsFixes available
npm/fast-uri>=4.0.0<4.1.3
4.1.3
npm/fast-uri>=3.0.0<3.1.6
3.1.6
npm/fast-uri>=2.3.1<2.4.5
2.4.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/fast-uri to a version that resolves this vulnerability.

    Fixed in 4.1.3
  2. Upgrade

    Upgrade npm/fast-uri to a version that resolves this vulnerability.

    Fixed in 3.1.6
  3. Upgrade

    Upgrade npm/fast-uri to a version that resolves this vulnerability.

    Fixed in 2.4.5
  4. Upgrade

    Upgrade fast-uri to a version that resolves this vulnerability.

    Fixed in 2.4.5
  5. Upgrade

    Upgrade fast-uri to a version that resolves this vulnerability.

    Fixed in 3.1.6
  6. Upgrade

    Upgrade fast-uri to a version that resolves this vulnerability.

    Fixed in 4.1.3
  7. Compensating control

    Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri, because malformed IPv6 literals can be normalized/truncated in fast-uri (parse().error is unset) and used to route requests to loopback/unique-local/link-local addresses.

Event History

Sep 2, 2026
Advisory Published
via GitHub·03:43 PM
Data Sourced
via GitHub·03:43 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Which applications are realistically exposed to this issue?

Applications that accept untrusted URLs and normalize them with fast-uri before making outbound requests, following redirects, or enforcing host-based policy are exposed. The practical risk is SSRF or policy bypass when malformed bracketed IPv6 input is transformed into a loopback, unique-local, or link-local address.

2

Can checking parse().error detect malicious malformed IPv6 hosts?

No. For the affected malformed bracketed IPv6 literals, parse().error is unset even though the host is truncated and normalized to a different valid IPv6 address.

3

What should be done if upgrading cannot happen immediately?

Reject untrusted URLs with bracketed IPv6-literal hosts before passing them to fast-uri. For outbound connections, enforce an explicit allowlist of destination addresses rather than relying on the normalized host.

4

Which fast-uri releases contain the fix?

Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. These releases reject malformed IPv6 literals with a host error instead of normalizing them to a valid address.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203