Description

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T10:16:39.960Z",
  "pubdate": "2026-08-24T10:16:39.960Z",
  "executiveSummary": "The fast-uri Node.js package contains an incomplete-fix variant vulnerability related to CVE-2026-6322, specifically involving improper percent-encoding handling during URI parsing and authority recomposition.\nThe flaw allows nested percent-encoded input within a hostname to be decoded twice during a single call to normalize or resolve operations. This directly violates RFC 3986 section 2.4, which mandates that implementations must not decode the same string more than once.\nThe primary impact of this vulnerability includes Server-Side Request Forgery (SSRF) and host-policy bypass primitives.\nAffected systems include the fast-uri product across versions 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3.\nAn attacker can exploit this behavior by supplying a crafted, doubly encoded host string—such as one representing a loopback name or address—which ultimately resolves to an unintended network destination during outbound routing, redirect validation, or host-policy checks.\nRisk implications are significant for server-side applications that validate untrusted URIs prior to outbound requests, as security controls relying on the initial encoded representation can be systematically bypassed.",
  "technicalDetails": "The root cause of the vulnerability lies in the URI parsing and authority recomposition logic within fast-uri. The parser decodes percent escapes in a hostname during the initial parsing phase and subsequently decodes the parsed hostname a second time during authority recomposition.\nThis double-decoding behavior enables an attacker to craft a payload using nested percent-encoding. For example, a doubly encoded host string that spells out a loopback name or internal IP address remains obfuscated during initial inspection but decodes to the live target host in a single operation of normalize or resolve.\nThe vulnerable component handles URI normalization and resolution functions within the affected library versions: 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3.\nThe step-by-step attack flow proceeds as follows: First, an attacker supplies an untrusted URI containing a nested percent-encoded hostname to an application utilizing fast-uri. Second, the application passes this URI to the fast-uri normalization or resolution routine. Third, the library decodes the percent escapes during parsing and performs a secondary decode during authority recomposition. Fourth, the URI evaluates to a completely different network destination, such as a loopback interface or internal address, than what was initially presented. Finally, outbound routing mechanisms, redirect validators, or host-policy enforcement filters evaluate the transformed destination, allowing the forged request to bypass security controls and reach restricted internal resources."
}