Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-v2hh-gcrm-f6hx

Опубликовано: 21 июл. 2026
Источник: github
Github: Прошло ревью
CVSS3: 7.5

Описание

fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact

fast-uri v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's native WHATWG URL (used by fetch(), undici, and Node's http/https clients) normalizes \ to / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input string.

For example, http://evil.com\@allowed.com is treated by fast-uri as host allowed.com with userinfo evil.com\, while Node's WHATWG URL parser and fetch() see host evil.com with path /@allowed.com.

Applications that use fast-uri to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.

Patches

Upgrade to fast-uri v4.1.1, v3.1.4, or v2.4.3.

Workarounds

None. Upgrade to the patched version.

Пакеты

Наименование

fast-uri

npm
Затронутые версииВерсия исправления

>= 2.3.1, <= 2.4.2

2.4.3

Наименование

fast-uri

npm
Затронутые версииВерсия исправления

>= 3.0.0, <= 3.1.3

3.1.4

Наименование

fast-uri

npm
Затронутые версииВерсия исправления

>= 4.0.0, <= 4.1.0

4.1.1

EPSS

Процентиль: 17%
0.00254
Низкий

7.5 High

CVSS3

Дефекты

CWE-436

Связанные уязвимости

CVSS3: 7.5
ubuntu
29 дней назад

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

CVSS3: 7.5
redhat
30 дней назад

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

CVSS3: 7.5
nvd
29 дней назад

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

CVSS3: 7.5
debian
29 дней назад

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...

EPSS

Процентиль: 17%
0.00254
Низкий

7.5 High

CVSS3

Дефекты

CWE-436