Description

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a patched version.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T10:16:40.113Z",
  "pubdate": "2026-08-24T10:16:40.113Z",
  "executiveSummary": "The fast-uri package for Node.js suffers from a host confusion vulnerability arising from inconsistent host canonicalization logic across its API entry points. Specifically, the parser only canonicalizes a host to its ASCII form when the input carries an explicit scheme, leaving scheme-relative references (such as those preceded by two slashes) with their host verbatim and no error set.\nThis discrepancy causes internal functions like parse, resolve, normalize, and equal to yield disparate host representations for the same logical input depending solely on the presence of an explicit scheme. Consequently, the equal function can return contradictory verdicts for identical pairs of hosts.\nThe impact of this flaw involves policy bypasses and host confusion scenarios within applications utilizing fast-uri. If an application extracts a host to enforce security policies and subsequently resolves the reference, the security decision may be evaluated against one host while the actual network request is directed to another.\nAffected versions comprise 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. Exploitation requires an attacker to supply maliciously crafted URI inputs with scheme-relative references to deceive security controls relying on fast-uri parsing.",
  "technicalDetails": "The root cause of the vulnerability resides in the conditional canonicalization logic of the fast-uri URI parser. The parser enforces ASCII form conversion for hosts exclusively when the input URI explicitly defines a scheme. When processing scheme-relative references—such as network-path references beginning with two slashes—the parser bypasses ASCII canonicalization and preserves the host verbatim without triggering parsing errors.\nThe vulnerable components include the parser and utility entry points of fast-uri, namely the parse, resolve, normalize, and equal functions. Because these components handle scheme-relative inputs differently from explicitly schemed inputs, they return inconsistent host strings for semantically equivalent references.\nThe affected product is fast-uri across version ranges 2.4.2 up to 2.4.5 (exclusive), 3.1.3 up to 3.1.6 (exclusive), and 4.0.1 up to 4.1.3 (exclusive).\nThe attack flow proceeds as follows: 1) An attacker supplies a carefully crafted URI containing a scheme-relative reference designed to evade detection or exploit parsing discrepancies. 2) A consuming application invokes fast-uri to parse the input and extract the host for security evaluation against a policy or allowlist. 3) Because the scheme is omitted, the parser returns a non-canonicalized host that evades the security check or bypasses string-matching rules. 4) The application subsequently passes the same reference to the resolution engine (resolve), which interprets or normalizes the host differently. 5) The application makes an authorization or routing decision based on the initial host extraction, while the downstream network operation targets a different destination host, resulting in host confusion.\nPost-exploitation impact includes security policy bypass, unauthorized resource access, and potential Server-Side Request Forgery (SSRF) if the confused host routes traffic to unintended external or internal infrastructure."
}