You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore(deps): update dependency fast-uri@>=3.0.0 <3.1.8 to v3.1.9 [security] - #349
fast-uri versions >= 2.4.2, <= 2.4.7, >= 3.1.3, <= 3.1.8, and >= 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser with no error set: data before an @ is dropped and whitespace is removed.
For example, fast-uri parses http://a@b@evil.example/ to host evil.example (dropping the b segment), and a host containing a raw TAB, CR, or LF has those characters stripped. equal() then treats a whitespace-smuggled host as the same as the clean one, and resolve() rewrites the authority the same way.
Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host fast-uri returns differs from what was checked, and traffic can be steered to an unintended destination.
Patches
Upgrade to fast-uri2.4.8, 3.1.9, or 4.2.3.
Workarounds
Reject URIs whose authority contains more than one @, or contains TAB, CR, or LF, before calling fast-uri. Alternatively, treat any non-empty parse(x).error as fatal, and compare hosts only from the same parse() result.
This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.
Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.
Upgrade with:
npm install fast-uri@3.1.9
Thanks to @zekth for reporting the scheme, host, and relative-reference issues, and to @UlisesGascon for finding the suffix-reference issue and reviewing the remediations.
What's Changed
ci: enable trusted publishing releases (v3.x) by @mcollina in #229
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.
Comparing renovate/npm-fast-uri-=3.0.0-3.1.8-vulnerability (43a3b09) with main (b9f205d)1
Footnotes
No successful run was found on main (248c6f0) during the generation of this report, so b9f205d was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.1.8→3.1.9](https://renovatebot.com/diffs/npm/fast-uri@>=3.0.0 <3.1.8/3.1.8/3.1.9)Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110180 / GHSA-wjr9-j795-jxcr
More information
Details
Impact
fast-uriversions>= 2.4.2, <= 2.4.7,>= 3.1.3, <= 3.1.8, and>= 4.0.1, <= 4.2.2can silently rewrite the host of an HTTP-family URL (http,https,ws,wss, or any scheme withdomainHost: true). For those schemescanonicalizeHost()passes the parsed host to the WHATWGURLparser and adopts its.hostnamewithout checking that the parser read the whole input as a host. RFC 3986 permits@inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authorityfast-urireports is rewritten by that second parser with noerrorset: data before an@is dropped and whitespace is removed.For example,
fast-uriparseshttp://a@b@evil.example/to hostevil.example(dropping thebsegment), and a host containing a raw TAB, CR, or LF has those characters stripped.equal()then treats a whitespace-smuggled host as the same as the clean one, andresolve()rewrites the authority the same way.Applications that use
fast-urito enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical hostfast-urireturns differs from what was checked, and traffic can be steered to an unintended destination.Patches
Upgrade to
fast-uri2.4.8,3.1.9, or4.2.3.Workarounds
Reject URIs whose authority contains more than one
@, or contains TAB, CR, or LF, before callingfast-uri. Alternatively, treat any non-emptyparse(x).erroras fatal, and compare hosts only from the sameparse()result.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
fastify/fast-uri (fast-uri@>=3.0.0 <3.1.8)
v3.1.9Compare Source
Security
This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.
Upgrade with:
Thanks to @zekth for reporting the scheme, host, and relative-reference issues, and to @UlisesGascon for finding the suffix-reference issue and reviewing the remediations.
What's Changed
Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.