Is CVE-2026-86472 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86472 being exploited in the wild.

How severe is CVE-2026-86472?

Medium severity, with a CVSS score of 4.8, published 15 September 2026.

Which products and versions are affected?

fast-uri (npm) SEMVER:introduced=0,fixed=2.4.7.

Is there a fix for CVE-2026-86472?

Yes. fast-uri (npm): upgrade to 2.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86472 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86472?

Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86472: fast-uri inconsistent host case normalization via percent-encoded octets

CVE-2026-86472 · Severity: medium · CVSS 4.8 · Published 2026-09-15

fast-uri is a URL parser library used by Node.js projects like Fastify and ajv. Due to a flaw in how it handles uppercase letters in URLs, attackers can craft malformed URLs that bypass security controls like hostname allowlists or denylists, allowing them to reach blocked hosts. This could enable unauthorized access to services that should have been restricted.

Technologies: fast-uri (npm). Vendors: npm.

Quick answers

Is CVE-2026-86472 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86472 being exploited in the wild.
How severe is CVE-2026-86472?: Medium severity, with a CVSS score of 4.8, published 15 September 2026.
Which products and versions are affected?: fast-uri (npm) SEMVER:introduced=0,fixed=2.4.7.
Is there a fix for CVE-2026-86472?: Yes. fast-uri (npm): upgrade to 2.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86472 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86472?: Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-uri (npm): upgrade to 2.4.7 or later
```
npm install fast-uri@2.4.7
```

Technical details

The vulnerability is a case-sensitivity flaw in the RFC 3986 URI parser. fast-uri folds the host to lowercase before percent-decoding, so a percent-encoded uppercase octet like %41 (which decodes to 'A') is never lowercased. For scheme-relative URLs (//host), the host canonicalization step that would normally fix this is skipped, causing parse(), normalize(), and equal() functions to disagree on the same host. An application using case-sensitive host decisions on fast-uri output (e.g., comparing parse(url).host or using fast-uri.equal) can be bypassed with a percent-encoded uppercase octet. Since hostnames are case-insensitive in DNS and HTTP, the evading URL still reaches the intended (blocked) host. The issue affects versions before 2.4.7, 3.0.0–3.1.7, and 4.0.0–4.1.4; fixes are available in 2.4.7, 3.1.8, and 4.1.5.

Affected products

fastify fast-uri before 2.4.7, 3.0.0 through 3.1.7, 4.0.0 through 4.1.4

Identifiers

CVE-2026-86472
GHSA-hrr3-gc8f-f4qj

Timeline

2026-09-15: disclosed
2026-09-15: patched: Fixed in versions 2.4.7, 3.1.8, and 4.1.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.