fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
### Impact `fast-uri` folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as `%41` decodes to a literal `A` that is never folded. For a scheme-relative reference (`//host`) there is no scheme, so the host canonicalization that repairs this on a scheme-bearing URL does not run. As a result `parse`, `normalize`, and `equal` disagree on the same host: `parse("//%41.com").host` returns `"A.com"` while `parse("//a.com").host` and `parse("//A.com").host` return `"a.com"`, and `equal("//%41.com", "//a.com")` is `false` even though `equal("//A.com", "//a.com")` is `true`. An application that makes a case-sensitive host decision on `fast-uri` output for a scheme-relative reference, for example a host allowlist or denylist that compares `parse(url).host` or uses `fast-uri.equal`, can be steered past the check with a percent-encoded uppercase octet. Because a hostname is case-insensitive in DNS and HTTP routing, the evading spelling reaches the same host the check meant to gate, so the effect is check evasion rather than reaching a different registrable host. ### Patches Upgrade to `fast-uri` 4.1.5, 3.1.8, or 2.4.7. ### Workarounds Compare hosts case-insensitively (lowercase the parsed host before any allowlist or denylist decision), or avoid making case-sensitive host decisions on scheme-relative input until upgrading.
GHSA-hrr3-gc8f-f4qj
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-hrr3-gc8f-f4qj
fast-uri
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.7
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
fast-uri
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.1.8
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
fast-uri
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.1.5
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.7"
}
]
}
],
"package": {
"name": "fast-uri",
"purl": "pkg:npm/fast-uri",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hrr3-gc8f-f4qj/GHSA-hrr3-gc8f-f4qj.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.8"
}
]
}
],
"package": {
"name": "fast-uri",
"purl": "pkg:npm/fast-uri",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hrr3-gc8f-f4qj/GHSA-hrr3-gc8f-f4qj.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.5"
}
]
}
],
"package": {
"name": "fast-uri",
"purl": "pkg:npm/fast-uri",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hrr3-gc8f-f4qj/GHSA-hrr3-gc8f-f4qj.json"
}
}
]- Related CVEs
- CVE-2026-86472
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #33273 · Revision 1
- Added to Heist Feed
- Publisher date