Description

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T11:16:40.723Z",
  "pubdate": "2026-08-24T11:16:40.723Z",
  "executiveSummary": "A URI parsing vulnerability exists in the fast-uri Node.js library, specifically involving improper handling and legacy decoding of the scheme component.\nThe vulnerability allows an attacker to supply a specially crafted input URI containing percent-encoded slashes or non-standard escape sequences within the scheme, which bypasses parsing security checks.\nWhen applications rely on the parsed host component for security decisions such as allowlisting or safely resolving relative references, the mismatch between the parsed output and the normalized or serialized output leads to severe security bypasses.\nThe resulting impact includes open redirection, server-side request forgery (SSRF), and address-policy bypasses.\nAffected products include fast-uri versions 2.3.1 up to 2.4.5, 3.0.0 up to 3.1.6, and 4.0.0 up to 4.1.3.\nExploitation requires an attacker to supply malicious URI inputs to an application that processes untrusted URIs without enforcing strict validation on scheme components post-decoding.",
  "technicalDetails": "The vulnerability resides in the URI parsing and serialization logic of the fast-uri package for Node.js.\nDuring the parsing phase, the library executes a legacy decoding pass over the scheme component and fails to re-escape the resulting output.\nConversely, serialization writes the scheme component back out verbatim without applying the re-escaping mechanisms utilized for other components like the host.\nWhen an input URI carries percent-encoded slashes within its scheme, the parser misinterprets the structure, resulting in a parsed URI where the scheme yields no authority, rendering both the parsed host and error fields as undefined.\nHowever, when that identical input is subsequently resolved or normalized by the library, it emits a network-path reference containing an attacker-chosen authority that successfully re-parses to the injected host.\nFurthermore, the legacy decoder improperly expands non-standard escape forms, bypassing upstream filters, and permits raw control characters such as carriage returns and line feeds to reach the output stream.\nApplications that perform security checks by allowlisting on the initially parsed host, or those that assume a reference lacking a parsed authority is safe to resolve against a base URI, encounter a logic inversion.\nThe step-by-step attack flow involves an attacker submitting a crafted URI with an encoded scheme, the application validating the undefined or benign parsed host, and the application subsequently resolving or normalizing the URI to trigger an off-site redirect, SSRF, or address-policy bypass to an unintended external resource.\nThe vulnerability affects versions 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3."
}