Executive brief
A vulnerability in the fast-uri library, a tool used for high-performance web address parsing, can lead to security bypasses. Because this library interprets certain characters (like backslashes) differently than standard web browsers and Node.js, an attacker can craft a malicious link that appears safe to security filters but directs users or data to a malicious destination. This could allow attackers to bypass access controls, redirect users to phishing sites, or perform Server-Side Request Forgery (SSRF) attacks.
Technical details
The fast-uri library (v4.1.1 and earlier) fails to recognize backslashes ('\\') as valid authority introducers, whereas Node.js's WHATWG URL parser treats them as interchangeable with forward slashes ('/') for special schemes like http and https. This creates an interpretation conflict (CWE-436) where fast-uri may parse a malicious URI as a relative path on a trusted host, while the underlying Node.js client (fetch, http, etc.) treats it as a different, potentially malicious host. Attackers can exploit this desync to bypass host-based security policies such as allowlists, redirect validation, and SSRF filters. The issue is resolved in versions 4.1.2, 3.1.5, and 2.4.4.
Affected products
- fastify fast-uri < 2.4.4, >= 3.0.0 < 3.1.5, >= 4.0.0 < 4.1.2
Timeline
- 2026-07-31: patched: Fixes released in multiple branches
- 2026-07-31: disclosed: NVD publication date
- 2026-08-03: advisory: GitHub Advisory published
References
- https://api.github.com/users/alanturing881
- https://github.com/alanturing881
- https://api.github.com/users/alanturing881/gists%7B/gist_id%7D
- https://api.github.com/users/alanturing881/repos
- https://avatars.githubusercontent.com/u/286391906?v=4
- https://api.github.com/users/alanturing881/events%7B/privacy%7D