# CVE-2026-75931: Fastify fast-uri host confusion via skipped IDN canonicalization

Source: https://junglewise.ai/threats/cve-2026-75931-fastify-fast-uri-host-confusion-via-skipped-idn-canonicalization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75931 · Severity: high · CVSS 7.5 · Published 2026-08-24

fast-uri is a URL parsing and resolution library used by web applications to process and normalize Internationalized Domain Names (IDN). When resolving scheme-relative URLs (those starting with //), the library fails to properly convert non-ASCII hostnames to their canonical ASCII form. An attacker can craft a malicious URL that causes an application to make a security decision (such as access control or routing) based on one hostname but then actually connect to a different one, potentially bypassing allowlist checks or reaching unintended backend services.

Technologies: [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-75931 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75931 being exploited in the wild.

**How severe is CVE-2026-75931?** High severity, with a CVSS score of 7.5, published 24 August 2026.

**Which products and versions are affected?** fast-uri (npm) SEMVER:introduced=2.4.2,fixed=2.4.5.

**Is there a fix for CVE-2026-75931?** Yes. fast-uri (npm): upgrade to 2.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75931 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75931?** Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-uri (npm): upgrade to 2.4.5 or later

  ```sh
  npm install fast-uri@2.4.5
  ```


## Technical details

The vulnerability exists in the resolve() function of fast-uri, which handles URI resolution per RFC 3986. When a scheme-relative reference (//hostname/) is resolved against a base URI with an explicit scheme, the library correctly inherits the scheme but fails to canonicalize the resulting hostname via IDN processing. This means a non-ASCII hostname remains in its original form in the returned URI string, but when that URI is reparsed by another component, the IDN canonicalization is applied, resulting in a different ASCII hostname. The root cause is incomplete fix of CVE-2026-13676, which only applied IDN canonicalization to URIs with explicit schemes. An attacker can exploit this to resolve a reference against a base, check one hostname (the non-ASCII form), and reach a different canonical hostname (the ASCII form) on re-parsing. The fix (in versions 2.4.5, 3.1.6, 4.1.3) applies canonicalization once the effective scheme is known and fails closed if a non-ASCII hostname cannot be converted, preventing the mismatch.

## Affected products

- Fastify fast-uri >=2.4.2,<2.4.5; >=3.1.3,<3.1.6; >=4.0.1,<4.1.3

## Identifiers

- CVE-2026-75931
- GHSA-5jgf-p345-68v8

## Timeline

- 2026-08-23: disclosed
- 2026-09-02: patched: Patches released: fast-uri 2.4.5, 3.1.6, and 4.1.3
- 2026-09-02: advisory

## References

- [https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)
- [https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)
- [https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)
- [https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)
- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fast-uri](https://github.com/fastify/fast-uri)

## Related threats

- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri URI scheme spoofing via percent-encoded scheme](https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri host confusion via unchecked WHATWG canonicalization](https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri mailto header injection via percent-encoded field-name desynchronization](https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name)