# CVE-2026-86472: fast-uri inconsistent host case normalization via percent-encoded octets

Source: https://junglewise.ai/threats/cve-2026-86472-fast-uri-inconsistent-host-case-normalization-via-percent-encoded  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86472 · Severity: medium · CVSS 4.8 · Published 2026-09-15

fast-uri is a URL parser library used by Node.js projects like Fastify and ajv. Due to a flaw in how it handles uppercase letters in URLs, attackers can craft malformed URLs that bypass security controls like hostname allowlists or denylists, allowing them to reach blocked hosts. This could enable unauthorized access to services that should have been restricted.

Technologies: [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-86472 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86472 being exploited in the wild.

**How severe is CVE-2026-86472?** Medium severity, with a CVSS score of 4.8, published 15 September 2026.

**Which products and versions are affected?** fast-uri (npm) SEMVER:introduced=0,fixed=2.4.7.

**Is there a fix for CVE-2026-86472?** Yes. fast-uri (npm): upgrade to 2.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86472 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86472?** Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-uri (npm): upgrade to 2.4.7 or later

  ```sh
  npm install fast-uri@2.4.7
  ```


## Technical details

The vulnerability is a case-sensitivity flaw in the RFC 3986 URI parser. fast-uri folds the host to lowercase before percent-decoding, so a percent-encoded uppercase octet like %41 (which decodes to 'A') is never lowercased. For scheme-relative URLs (//host), the host canonicalization step that would normally fix this is skipped, causing parse(), normalize(), and equal() functions to disagree on the same host. An application using case-sensitive host decisions on fast-uri output (e.g., comparing parse(url).host or using fast-uri.equal) can be bypassed with a percent-encoded uppercase octet. Since hostnames are case-insensitive in DNS and HTTP, the evading URL still reaches the intended (blocked) host. The issue affects versions before 2.4.7, 3.0.0–3.1.7, and 4.0.0–4.1.4; fixes are available in 2.4.7, 3.1.8, and 4.1.5.

## Affected products

- fastify fast-uri before 2.4.7, 3.0.0 through 3.1.7, 4.0.0 through 4.1.4

## Identifiers

- CVE-2026-86472
- GHSA-hrr3-gc8f-f4qj

## Timeline

- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in versions 2.4.7, 3.1.8, and 4.1.5

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj](https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj)

## Related threats

- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri URI scheme spoofing via percent-encoded scheme](https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri host confusion via unchecked WHATWG canonicalization](https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri mailto header injection via percent-encoded field-name desynchronization](https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name)