GHSA-f65p-4m7j-42xc: Input Validation
Impact
fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize('http://[::not-valid]/private') returns http://[::]/private, and [fc00::not-hex] and [fe80::not-hex] collapse to [fc00::] and [fe80::]. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (::1), unique-local, or link-local. Because parse().error is unset for these inputs, checking it does not protect the consumer.
Patches
Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. Malformed IPv6 literals are now rejected with a host error instead of being normalized to a valid address.
Workarounds
Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri, or route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Compensating control
Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri, because malformed IPv6 literals can be normalized/truncated in fast-uri (parse().error is unset) and used to route requests to loopback/unique-local/link-local addresses.
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications that accept untrusted URLs and normalize them with fast-uri before making outbound requests, following redirects, or enforcing host-based policy are exposed. The practical risk is SSRF or policy bypass when malformed bracketed IPv6 input is transformed into a loopback, unique-local, or link-local address.
Can checking parse().error detect malicious malformed IPv6 hosts?
No. For the affected malformed bracketed IPv6 literals, parse().error is unset even though the host is truncated and normalized to a different valid IPv6 address.
What should be done if upgrading cannot happen immediately?
Reject untrusted URLs with bracketed IPv6-literal hosts before passing them to fast-uri. For outbound connections, enforce an explicit allowlist of destination addresses rather than relying on the normalized host.
Which fast-uri releases contain the fix?
Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. These releases reject malformed IPv6 literals with a host error instead of normalizing them to a valid address.