GHSA-jqff-g426-hqxp: High severity npm/fast-uri vulnerability
Impact
fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape() and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore introduce structure the original input did not contain.
For example, %2f%2fevil.example:/pwn parses with no authority (parse().host is undefined), but resolve() and normalize() return //evil.example:/pwn, which reparses with host evil.example. The %uXXXX form (%u002f%u002fevil.example:/pwn) produces the same result, and a scheme containing %0d%0a reaches the output as a raw CR LF.
Applications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision, especially ones that treat a missing authority as same-origin, can be steered to an attacker-chosen authority, and a normalized URI placed in a response header can carry an injected CR LF.
Patches
Upgrade to fast-uri >= 4.1.3, or >= 3.1.6 in the v3.x release line, or >= 2.4.5 in the v2.x release line.
Workarounds
None. Upgrade to the patched version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Configuration
Do not call resolve()/normalize() on untrusted URLs prior to security decisions such as redirect validation, host allowlisting, or deciding outbound requests; perform those checks before any normalization. Also prevent placing normalized URIs into response headers without strict validation/escaping to stop CRLF injection.
fast-uri URL normalization/resolve usage = Avoid normalizing or resolving untrusted URLs before redirect checks, host allowlist checks, or outbound request decisions - Compensating control
Ensure redirects, host allowlisting, and outbound request decisions are performed on the original (un-normalized/un-resolved) untrusted URL input, and that a missing authority is not treated as same-origin.
Event History
Frequently Asked Questions
Which applications are realistically exposed to exploitation?
Applications are exposed when they normalize or resolve untrusted URLs before making a redirect decision, checking a host allowlist, or deciding whether to send an outbound request. Risk is especially high when a missing authority is treated as same-origin, because the normalized result can reparse with an attacker-controlled host.
What input does an attacker need to exploit the issue?
An attacker needs control of a URL that reaches fast-uri parsing and then normalize() or resolve(). Percent-encoded scheme content such as %2f%2fevil.example:/pwn, legacy %u002f encoding, or %0d%0a can decode into structural characters in the output.
Can this lead to response-header injection?
Yes. A scheme containing percent-encoded CR LF (%0d%0a) is emitted as raw CR LF, so a normalized URI placed into a response header can carry an injected line break.
What should be done if the application uses an affected release?
There is no workaround listed. Upgrade fast-uri to version 4.1.3 or later, 3.1.6 or later for the v3.x line, or 2.4.5 or later for the v2.x line.