Executive brief
fast-uri is a JavaScript library for parsing and manipulating URLs used by many web applications to validate domains for security policies like SSRF denylists and redirect allowlists. The library fails to detect malformed hosts with unbalanced brackets (e.g., "[@127.0.0.1"), returning them without error while Node.js HTTP clients resolve the same URL to a different host (127.0.0.1). An attacker can craft URLs that bypass security checks, potentially allowing unauthorized requests to internal systems or arbitrary redirects.
Technical details
The vulnerability is an interpretation conflict (CWE-436) in fast-uri's host parsing. The library accepts hosts containing unbalanced or misplaced brackets ([ or ]) without validation or error reporting, treating them as literal domain names. However, Node.js URL and HTTP clients (http.get, axios, got) parse the same string differently, extracting the actual host from within or after the bracket. An attacker can exploit this desynchronization by crafting URLs like "http://[@127.0.0.1/path" that bypass host validation checks in security policies while the HTTP client resolves to 127.0.0.1. The issue affects parse(), normalize(), equal(), and resolve() functions. Patches are available in fast-uri 2.4.6, 3.1.7, and 4.1.4, where parse() now reports "URI host is malformed" for any bracketed host that is not a valid IPv6 literal.
Affected products
- OpenJS Foundation fast-uri 2.4.5, 3.1.6, 4.1.3
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Patches released: versions 2.4.6, 3.1.7, 4.1.4