Description

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T10:16:40.237Z",
  "pubdate": "2026-08-24T10:16:40.237Z",
  "executiveSummary": "The fast-uri URI parser for Node.js suffers from a flaw in its custom parser for bracketed IPv6 literals, leading to improper input validation and Server-Side Request Forgery (SSRF).\nSpecifically, the parser fails to validate the complete IPv6 grammar, allowing invalid trailing text within an authority component to be silently discarded. This transforms a malformed, attacker-controlled host into a different, structurally valid IPv6 destination.\nFor instance, bracketed literals containing invalid trailing characters are improperly normalized to the unspecified address, causing Node HTTP clients to connect to local services over the loopback interface. Other malformed literals collapse into private-range IP addresses.\nCrucially, no error is set on the parsed output object, preventing consuming applications from detecting the malicious rewrite via standard error-checking mechanisms.\nAn attacker can exploit this behavior to bypass address-policy enforcement, security filters, or normalization routines that inspect untrusted URLs prior to outbound HTTP requests, redirects, or proxy routing.\nAffected products include fast-uri versions 2.3.1 up to 2.4.5, 3.0.0 up to 3.1.6, and 4.0.0 up to 4.1.3.\nRemediation requires upgrading to the patched versions 2.4.5, 3.1.6, or 4.1.3, which enforce strict grammar validation and correctly flag malformed literals as authority errors.",
  "technicalDetails": "The vulnerability resides within the custom parsing logic implemented in fast-uri for handling bracketed IPv6 literals within URI authorities.\nThe vulnerable component is the URI normalization and parsing engine responsible for processing host strings inside bracketed enclosures.\nThe root cause is a deficiency in the grammar validation routines for IPv6 literals. Instead of rejecting malformed syntax or flagging a parsing failure when unexpected trailing characters are appended to an IPv6 address, the parser strips or ignores the trailing data.\nConsequently, an attacker-crafted authority containing invalid trailing text is normalized into a completely different, yet syntactically valid, target IP address.\nFor example, feeding a specifically crafted bracketed literal with invalid trailing characters causes the parser to collapse the input into the unspecified IPv6 address (::).\nWhen an application utilizes this normalized URL in a Node HTTP client, the underlying network stack resolves the unspecified address to the local loopback interface.\nAlternative payload structures force the parser to evaluate malformed literals into private-range IP addresses.\nBecause the parser does not populate any error flags or error fields on the resulting parsed object, applications relying on conditional checks such as if (parsed.error) are entirely blind to the transformation.\nThe attack flow proceeds as follows: First, an attacker supplies an untrusted, malformed URL containing an invalid bracketed IPv6 literal designed to trigger the flawed parsing logic. Second, the vulnerable fast-uri library processes the URL, silently discarding the invalid trailing characters and rewriting the host into a loopback or private-range IPv6 address without raising an exception. Third, the host application normalizes the URL and passes it to an outbound request mechanism, redirect handler, or proxy routing engine. Fourth, the Node HTTP client connects to the unintended internal resource, resulting in Server-Side Request Forgery (SSRF) and the complete bypass of address-policy enforcement controls.\nAffected version ranges are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3.\nThe vulnerability can be triggered via untrusted input processed by network-facing services without requiring authentication or specific privileges."
}