Listen to this Post
fast-uri is a high‑performance URI parsing library for Node.js, commonly used in Fastify and related middleware. A high‑severity vulnerability arises from inconsistent Internationalized Domain Name (IDN) canonicalization during the resolution of scheme‑relative references. The library applies Punycode encoding to a hostname only when the input URI contains an explicit scheme (e.g., https://example.com`). When the `resolve()` method processes a scheme‑relative reference like `//examplé.com/` against a scheme‑bearing base (e.g.,https://trusted.com/api`), it inherits the base’s scheme but does not invoke the canonicalization routine on the host. As a result, the resolved URI is returned with the host in its raw Unicode form—examplé.com—while the internal effective scheme is known. If an application subsequently re‑parses that resolved URI or performs a host‑based security check (e.g., origin validation, allowlist matching), it will operate on the raw Unicode string. A later canonicalisation step, however, would convert it to xn--exampl-9oa.com, potentially corresponding to a different registered domain. This discrepancy allows an attacker to craft a scheme‑relative reference that passes a policy check against a trusted domain (because the check sees the Unicode form) but actually resolves to a malicious IDN homograph upon actual network resolution. The vulnerability is an incomplete‑fix variant of CVE‑2026‑13676: the original patch only added IDN canonicalization to the initial parse path when a scheme was explicitly present, but completely overlooked the `resolve()` codepath for relative references. Thus, any application that uses `resolve()` on untrusted input and then relies on the hostname for security decisions is exposed. The attack vector is especially dangerous in reverse‑proxy configurations, API gateways, and authentication bypass scenarios where routing decisions are based on the host header or origin. The maintainers have now corrected this by ensuring `resolve()` canonicalizes the host as soon as the effective scheme is known and fails closed (throwing an error) if a raw non‑ASCII host cannot be converted to ASCII. All vulnerable versions share the same flawed resolution logic, making this a systemic issue across multiple release lines.
DailyCVE Form:
Platform: fast-uri (Node.js)
Version: 2.4.2‑2.4.4, 3.1.3‑3.1.5, 4.0.1‑4.1.2
Vulnerability: IDN canonicalization bypass (scheme‑relative)
Severity: High
date: 2026‑08‑23
Prediction: Already patched (2.4.5, 3.1.6, 4.1.3)
What Undercode Say:
Check installed fast-uri version
npm list fast-uri
Audit for known vulnerabilities
npm audit –json | grep -A 10 “fast-uri”
Verify if your version is vulnerable (example script)
node -e “const pkg = require(‘./node_modules/fast-uri/package.json’); console.log(pkg.version);”
Simulate the resolution flaw (pre‑patch behaviour)
node -e “
const { resolve } = require(‘fast-uri’);
const base = ‘https://trusted.com/’;
const ref = ‘//examplé.com/path’;
console.log(‘Resolved:’, resolve(base, ref)); // host remains ‘examplé.com’
”
Upgrade to safe version
npm install [email protected] or 2.4.5 / 3.1.6
Exploit: (Educational Purposes!)
const { resolve, parse } = require(‘fast-uri’);
// Base with a scheme
const base = ‘https://allowlist.com/’;
// Attacker‑controlled scheme‑relative reference (IDN homograph)
const maliciousRef = ‘//examplé.com/admin’;
// Step 1: resolve() returns host as raw Unicode
const resolved = resolve(base, maliciousRef);
console.log(‘Resolved host (raw):’, parse(resolved).host); // ‘examplé.com’
// Step 2: Application policy check on raw host – passes because ‘examplé.com’ is trusted
if (parse(resolved).host === ‘examplé.com’) {
console.log(‘✅ Policy check passed – routing to trusted host’);
}
// Step 3: Actual re‑parse or downstream fetch canonicalizes to Punycode
const canonicalHost = new URL(resolved).hostname; // forces canonicalization
console.log(‘Canonical host:’, canonicalHost); // ‘xn--exampl-9oa.com’ – attacker controlled domain
// Result: request is sent to ‘xn--exampl-9oa.com’, bypassing the trust decision.
Protection:
- Upgrade immediately to
[email protected],@3.1.6, or@4.1.3, where `resolve()` canonicalizes the host and throws on non‑convertible IDN. - As a workaround, always resolve scheme‑relative references against a base that explicitly includes a scheme, and then manually canonicalize the host (e.g., using `new URL()` or
punycode.toASCII()) before any policy decision. - Avoid using the raw host string from `resolve()` for origin checks – enforce a strict allowlist of ASCII‑only domains or use a trusted URI normalisation library that handles IDN consistently.
- Monitor for any custom patches or forks that may have backported the fix if you cannot upgrade immediately.
Impact:
Successful exploitation allows an attacker to confuse host‑based security controls, leading to policy bypass, server‑side request forgery (SSRF), cross‑origin misrouting, and authentication evasion. In proxy or gateway setups, this can forward requests to malicious external domains that appear to be trusted internal hosts. The flaw undermines any security layer that relies on the resolved hostname for access control, rate limiting, or caching keys, potentially exposing internal APIs or allowing data exfiltration via homograph attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
