Executive brief
fast-uri is a URL parsing and resolution library used by web applications to process and normalize Internationalized Domain Names (IDN). When resolving scheme-relative URLs (those starting with //), the library fails to properly convert non-ASCII hostnames to their canonical ASCII form. An attacker can craft a malicious URL that causes an application to make a security decision (such as access control or routing) based on one hostname but then actually connect to a different one, potentially bypassing allowlist checks or reaching unintended backend services.
Technical details
The vulnerability exists in the resolve() function of fast-uri, which handles URI resolution per RFC 3986. When a scheme-relative reference (//hostname/) is resolved against a base URI with an explicit scheme, the library correctly inherits the scheme but fails to canonicalize the resulting hostname via IDN processing. This means a non-ASCII hostname remains in its original form in the returned URI string, but when that URI is reparsed by another component, the IDN canonicalization is applied, resulting in a different ASCII hostname. The root cause is incomplete fix of CVE-2026-13676, which only applied IDN canonicalization to URIs with explicit schemes. An attacker can exploit this to resolve a reference against a base, check one hostname (the non-ASCII form), and reach a different canonical hostname (the ASCII form) on re-parsing. The fix (in versions 2.4.5, 3.1.6, 4.1.3) applies canonicalization once the effective scheme is known and fails closed if a non-ASCII hostname cannot be converted, preventing the mismatch.
Affected products
- Fastify fast-uri >=2.4.2,<2.4.5; >=3.1.3,<3.1.6; >=4.0.1,<4.1.3
Timeline
- 2026-08-23: disclosed
- 2026-09-02: patched: Patches released: fast-uri 2.4.5, 3.1.6, and 4.1.3
- 2026-09-02: advisory
References
- https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8
- https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5
- https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef
- https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fast-uri