Description

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-15T11:17:12.327Z",
  "pubdate": "2026-09-15T11:17:12.327Z",
  "executiveSummary": "The fast-uri library is vulnerable to a host canonicalization flaw resulting from improper processing order during URI normalization. This issue stems from the library performing host lowercasing before percent-decoding the host component.\nThis vulnerability allows attackers to bypass security controls—such as host allowlists or denylists—that rely on case-sensitive string comparisons of the parsed URI host. By utilizing percent-encoded uppercase octets (e.g., %41), an attacker can craft a URI that appears different from the intended target during the security check but resolves to the same target during subsequent HTTP or DNS resolution, as these protocols treat hostnames as case-insensitive.\nThe flaw affects fast-uri versions prior to 2.4.7, 3.0.0 through 3.1.7, and 4.0.0 through 4.1.4. Successful exploitation enables attackers to circumvent access control mechanisms, potentially leading to unauthorized resource access or server-side request forgery (SSRF) scenarios if the application trusts the 'fast-uri' output for routing or filtering decisions.\nNo authentication is required for exploitation, and the attack vector is network-accessible. The risk is critical for applications that perform security-sensitive logic based on the output of this URI parser.",
  "technicalDetails": "The root cause of this vulnerability lies in the incorrect sequence of operations during URI host canonicalization within the fast-uri library. Specifically, the library forces the hostname to lowercase before executing the percent-decoding process. This logic error prevents the proper normalization of percent-encoded characters that represent uppercase letters (e.g., %41 decoding to 'A').\nIn a standard URI, the host component is canonicalized to ensure that variations in spelling (such as case differences) are normalized for comparison. However, due to the incorrect ordering, a URI containing a percent-encoded uppercase octet remains in a state where the decoded character is never subjected to the lowercasing function. For example, a host string containing '%41' will be decoded into 'A', effectively bypassing a filter that expects 'a'.\nThe attack flow is particularly effective against scheme-relative references (e.g., //host). Because these references lack a scheme, the specific canonicalization logic intended to repair these issues is bypassed entirely during the parsing and normalization phases. When the application logic invokes 'parse', 'normalize', or 'equal' functions, the library returns a representation of the host that retains its original case (e.g., 'ExAmPlE.com'), causing a mismatch against the normalized expected value (e.g., 'example.com').\nAn attacker can exploit this by injecting percent-encoded characters into the URI host. If an application uses 'fast-uri' to validate a URL against an allowlist, the application compares the provided host against the trusted list. Because the 'fast-uri' output remains unconverted (preserving the case of the decoded characters), the security check may fail to recognize the domain as an entry on the blocklist or correctly validate it against an allowlist. Once the check is passed, the underlying HTTP client or DNS resolver—which operates on a case-insensitive basis—interprets the URI normally and connects to the intended, potentially forbidden, host.\nThis vulnerability specifically impacts the internal state consistency of the URI object. The discrepancy between the parser's logical output and the actual resolution behavior of standard network protocols allows for effective security filter evasion without requiring elevated privileges or special authentication."
}