Executive brief
fast-uri is a JavaScript library used by Node.js applications to parse and normalize URIs. A flaw in how it processes percent-encoded characters in the URI scheme component allows attackers to craft URLs that trick the library into changing which host is associated with the URL after normalization or resolution. Applications that use this library to validate URLs before redirects or API calls may be redirected to attacker-controlled domains, or have malicious line breaks injected into HTTP response headers.
Technical details
The vulnerability is a URL encoding normalization bypass (CWE-177). fast-uri decodes percent-encoded characters (e.g. %2f, %0d%0a) in the URI scheme using the legacy unescape() function, then serializes them back as raw characters without re-escaping or validating against RFC 3986 scheme grammar. An attacker can craft URIs like %2f%2fevil.example:/pwn that initially parse with no authority, but after normalize() or resolve() emit //evil.example:/pwn, which reparses with host evil.example. Schemes containing %0d%0a (CR LF) reach the output as raw control characters, enabling header injection in HTTP responses. Attack preconditions: the application must normalize/resolve untrusted URLs before redirect checks, host allowlists, or outbound requests, especially if it treats missing authority as same-origin. Patches are available: upgrade to fast-uri ≥ 4.1.3, ≥ 3.1.6 (v3 line), or ≥ 2.4.5 (v2 line).
Affected products
- Fastify fast-uri >=2.3.1, <2.4.5; >=3.0.0, <3.1.6; >=4.0.0, <4.1.3
Timeline
- 2026-08-23: disclosed: Vulnerability disclosed to GitHub Advisory Database
- 2026-09-02: advisory: GHSA-jqff-g426-hqxp and CVE-2026-76172 published
- 2026-09-02: patched: Patches released: v2.4.5, v3.1.6, v4.1.3