Executive brief
fast-uri is a URL parser library used by Node.js projects like Fastify and ajv. Due to a flaw in how it handles uppercase letters in URLs, attackers can craft malformed URLs that bypass security controls like hostname allowlists or denylists, allowing them to reach blocked hosts. This could enable unauthorized access to services that should have been restricted.
Technical details
The vulnerability is a case-sensitivity flaw in the RFC 3986 URI parser. fast-uri folds the host to lowercase before percent-decoding, so a percent-encoded uppercase octet like %41 (which decodes to 'A') is never lowercased. For scheme-relative URLs (//host), the host canonicalization step that would normally fix this is skipped, causing parse(), normalize(), and equal() functions to disagree on the same host. An application using case-sensitive host decisions on fast-uri output (e.g., comparing parse(url).host or using fast-uri.equal) can be bypassed with a percent-encoded uppercase octet. Since hostnames are case-insensitive in DNS and HTTP, the evading URL still reaches the intended (blocked) host. The issue affects versions before 2.4.7, 3.0.0–3.1.7, and 4.0.0–4.1.4; fixes are available in 2.4.7, 3.1.8, and 4.1.5.
Affected products
- fastify fast-uri before 2.4.7, 3.0.0 through 3.1.7, 4.0.0 through 4.1.4
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in versions 2.4.7, 3.1.8, and 4.1.5