Description

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T20:17:39.543Z",
  "pubdate": "2026-09-02T20:17:39.543Z",
  "executiveSummary": "The fast-uri library is susceptible to an authority component injection vulnerability arising from improper input validation during URI serialization. The root cause lies in the failure to sanitize or validate the port component, which is concatenated verbatim when recomposing the authority section of a URI.\nBy providing a non-numeric port value, an attacker can inject authority delimiters such as '@' or '/', effectively manipulating the URI structure. This allows for the redirection of the authority to an attacker-controlled host, as the userinfo and host components are misinterpreted by URI parsers.\nThe vulnerability affects fast-uri versions before 2.4.6, 3.0.0 through 3.1.6, and 4.0.0 through 4.1.3. Successful exploitation requires an attacker to control the input assigned to the port component during URI construction, normalization, or equality checks. The impact is significant as both the fast-uri library and the native Node.js URL parser interpret the malformed URI as pointing to the attacker-supplied host, bypassing downstream re-validation efforts. This may facilitate phishing, unauthorized data exfiltration, or man-in-the-middle attacks when applications rely on these URIs for network requests.",
  "technicalDetails": "The vulnerability exists within the URI authority recomposition process of the fast-uri library. According to RFC 3986, the port component of a URI authority must strictly consist of a sequence of digits. The library's internal logic, however, fails to enforce this requirement during the serialization process.\nDuring the execution of serialize, normalize, or equal functions, the library recomposes the authority component by concatenating the userinfo, host, and port. While userinfo and host are appropriately escaped to prevent injection, the port component is treated as a trusted, opaque string and concatenated without verification.\nAn attacker can exploit this by injecting authority delimiters into the port field. For example, if a port input is supplied as '80@evil.com', the resulting authority string becomes 'userinfo@host:80@evil.com'. When a URI parser (such as the native Node.js URL module) processes this string, it interprets the portion following the final delimiter as the intended host. Consequently, the original host is demoted to userinfo, and the authority reference is successfully hijacked to point to the attacker's server.\nThis vulnerability is particularly insidious because the injected URI is syntactically valid according to the parser's interpretation rules. Because both fast-uri and standard parsers read the resulting URI as the attacker's host, any post-serialization validation or normalization steps that rely on these parsers will fail to detect the manipulation.\nAffected components include the authority recomposition logic utilized by the library's primary object-based functions. The vulnerability is present across versions 2.x, 3.x, and 4.x as specified. Exploitation does not require authentication or elevated privileges, provided the application logic allows untrusted input to define the port property. The network exposure is broad, as any application building URIs from parts using affected versions of fast-uri to communicate with external services or to direct user traffic is potentially at risk.\nThe post-exploitation impact includes unauthorized redirection of sensitive requests, potentially leading to the leakage of authentication tokens or session data if the URI is used in outgoing HTTP requests, or the forced loading of malicious assets in client-facing applications."
}