Executive brief
A vulnerability in the fast-uri library, which is used for processing web addresses (URIs), can allow attackers to bypass security checks. By using specially formatted characters in a web link, an attacker can trick an application into connecting to a malicious website while appearing to connect to a trusted one. This could lead to unauthorized data redirection or the bypassing of security filters designed to restrict access to certain domains.
Technical details
The fast-uri library (v3.1.1 and earlier, and v2.4.0 and earlier) improperly handles percent-encoded authority delimiters such as %40 (@) and %3A (:) within the host component. During normalization, these characters are decoded and serialized back as raw characters, which fundamentally alters the URI's structure. For example, a URI like 'http://trusted.com%40evil.com/' is normalized to 'http://trusted.com@evil.com/', causing parsers to interpret 'evil.com' as the host and 'trusted.com' as user information. This interpretation conflict allows attackers to bypass allowlist checks or redirect validation. The issue is fixed in versions 3.1.2 and 2.4.1.
Affected products
- fastify fast-uri >= 3.0.0, <= 3.1.1
- fastify fast-uri <= 2.4.0
Timeline
- 2026-05-05: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched