Description

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T05:16:38.680Z",
  "pubdate": "2026-09-03T05:16:38.680Z",
  "executiveSummary": "fast-uri versions 2.4.5, 3.1.6, and 4.1.3 are susceptible to a host-parsing discrepancy vulnerability that facilitates Server-Side Request Forgery (SSRF).\nThe vulnerability arises when the library incorrectly handles malformed authority components—specifically unbalanced or misplaced square brackets—by failing to validate them as invalid IPv6 literals or canonicalized domains.\nThis creates a security mismatch between the host perceived by the application's security logic (e.g., allowlists or denylists) and the host actually resolved by downstream Node.js HTTP clients.\nAn attacker can exploit this discrepancy to bypass security controls by providing input that appears benign to the application's validation logic but routes to an unauthorized or internal destination when processed by the underlying HTTP client.\nSuccessful exploitation allows attackers to circumvent SSRF protections, potentially enabling unauthorized access to internal network resources, local services, or restricted metadata endpoints.",
  "technicalDetails": "The root cause of the vulnerability is improper input validation within the fast-uri parse() function. When an authority component begins with an opening bracket '[' but lacks a corresponding closing bracket ']', the parser fails to identify the string as a malformed host.\nInstead of returning an error, the function treats the malformed string as a valid host component. This creates a state where the library provides a parsed host string that is fundamentally different from how Node.js's native URL parser and standard HTTP clients resolve the same authority component.\nThe attack flow follows a clear pattern: First, an attacker crafts a malicious URI containing an unbalanced bracket in the host segment. Second, the application passes this URI to the fast-uri library to enforce security policies, such as validating a redirect target or checking an SSRF denylist.\nBecause fast-uri returns the host without error, the security policy evaluation logic treats the malformed input as the intended host, successfully validating it against security rules.\nThird, the application then transmits the original, unmodified URI to a Node.js-based HTTP client for request execution. Because the underlying HTTP client resolves the authority component differently than fast-uri, the request is directed to a destination that was not intended by the initial security policy.\nThis behavior persists across normalize(), equal(), and resolve() operations, ensuring the discrepancy is maintained throughout the URI lifecycle.\nThe technical implication is a critical bypass of security filters. If an application uses fast-uri to check if a host is permitted, an attacker can use this mismatch to access internal network infrastructure, bypass proxy routing restrictions, or interact with sensitive internal APIs that are protected by simple string-based filter mechanisms.\nThe issue is not limited to a specific network segment, as any application relying on fast-uri to process user-supplied URLs for outbound request logic is potentially vulnerable, regardless of authentication requirements or user privilege levels."
}