PT-2026-53267 · Npm · Fast-Uri

Celinke97 + 1 · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-13676

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 3.1.2 fast-uri version 4.0.0

Description The software fails to canonicalize Unicode Internationalized Domain Names (IDN) for HTTP-family URLs. This occurs because the IDN conversion path utilizes a helper missing from the global URL constructor, causing the host to remain in its original Unicode form. Consequently, the normalize() and equal() functions return values that differ from a WHATWG-compatible URL parser. This can lead to host confusion, allowing attackers to bypass host-based policies such as denylists, loopback filtering, redirect validation, or outbound proxy routing when the application uses fast-uri for validation but passes the URL to Node's URL or fetch for the actual request.

Recommendations Upgrade to version 3.1.3 for the 3.x line. Upgrade to version 4.0.1 for the 4.x line. Enforce host policy using the same URL parser used for the actual request. Reject non-ASCII hosts before performing policy checks.

Fix

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2026-13676

Affected Products

Fast-Uri

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-13676 · Security Note
• https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6 · Note
• https://cna.openjsf.org/security-advisories.html · Note
• https://twitter.com/kom_256/status/2071587850097762313 · Twitter Post