GHSA-hrr3-gc8f-f4qj

Dashboard / Vulnerabilities / GHSA-hrr3-gc8f-f4qj

GHSA-hrr3-gc8f-f4qj

Summary: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

Details: ### Impact `fast-uri` folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as `%41` decodes to a literal `A` that is never folded. For a scheme-relative reference (`//host`) there is no scheme, so the host canonicalization that repairs this on a scheme-bearing URL does not run. As a result `parse`, `normalize`, and `equal` disagree on the same host: `parse("//%41.com").host` returns `"A.com"` while `parse("//a.com").host` and `parse("//A.com").host` return `"a.com"`, and `equal("//%41.com", "//a.com")` is `false` even though `equal("//A.com", "//a.com")` is `true`. An application that makes a case-sensitive host decision on `fast-uri` output for a scheme-relative reference, for example a host allowlist or denylist that compares `parse(url).host` or uses `fast-uri.equal`, can be steered past the check with a percent-encoded uppercase octet. Because a hostname is case-insensitive in DNS and HTTP routing, the evading spelling reaches the same host the check meant to gate, so the effect is check evasion rather than reaching a different registrable host. ### Patches Upgrade to `fast-uri` 4.1.5, 3.1.8, or 2.4.7. ### Workarounds Compare hosts case-insensitively (lowercase the parsed host before any allowlist or denylist decision), or avoid making case-sensitive host decisions on scheme-relative input until upgrading.

References: https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj, https://nvd.nist.gov/vuln/detail/CVE-2026-86472, https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1, https://cna.openjsf.org/security-advisories.html, https://github.com/fastify/fast-uri, https://github.com/fastify/fast-uri/releases/tag/v2.4.7, https://github.com/fastify/fast-uri/releases/tag/v3.1.8, https://github.com/fastify/fast-uri/releases/tag/v4.1.5