Kaka

**Name of the Vulnerable Software and Affected Versions** fast-uri versions prior to 3.1.2 **Description** The `normalize()` function decoded percent-encoded authority delimiters within the host component and re-emitted them as raw delimiters during serialization. This allows a host combining an allowed domain, an encoded at-sign, and a different domain to be re-emitted with the at-sign as a raw userinfo separator, effectively changing the URI's authority to the second domain. Applications that normalize untrusted URLs before performing host allowlist checks, redirect validation, or outbound request routing can be steered to an authority different from the one specified in the input. **Recommendations** Update to version 3.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** fast-uri versions prior to 3.1.1 **Description** The `normalize()` and `equal()` functions decode percent-encoded path separators and dot segments before performing dot-segment removal. This causes encoded path data to be treated as actual slashes and parent-directory references, allowing distinct URIs to collapse into the same normalized path. Consequently, applications using these functions to enforce path-based policies on attacker-controlled URLs may be bypassed, as a path appearing confined under an allowed prefix can normalize to a different location. **Recommendations** Update to version 3.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions through 5.8.2 **Description** When the `trustProxy` setting is configured with a restrictive trust function—such as a specific IP address, a subnet, a hop count, or a custom function—the `request.protocol` and `request.host` getters incorrectly read `X-Forwarded-Proto` and `X-Forwarded-Host` headers from all connections, including those from untrusted sources. This allows an attacker connecting directly to Fastify, bypassing the proxy, to manipulate both the protocol and host as seen by the application. This issue only occurs when `trustProxy` is not set to `true`, which trusts all forwarded headers. Applications relying on `request.protocol` or `request.host` for security-sensitive operations—like HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, or host-based routing—are susceptible to attack when using a restrictive `trustProxy` configuration. **Recommendations** fastify versions through 5.8.2 should not use a restrictive `trustProxy` configuration. If a proxy is not used, do not configure `trustProxy`. If a proxy is used, set `trustProxy` to `true` to trust all forwarded headers, or configure a custom trust function that accurately identifies trusted proxy IPs.