← Terug naar overzicht

CVE-2026-75931 affects fast-uri, a URI parser for Node.js, across versions 2.4.2–2.4.4, 3.1.3–3.1.5, and 4.0.1–4.1.2. The vulnerability stems from inconsistent host canonicalization: the library only converts hosts to ASCII form when an explicit scheme is present, leaving scheme-relative references (e.g., //host) returned verbatim. This causes internal inconsistency between fast-uri's own functions (parse, resolve, normalize, equal), which can yield different host values for the same input. An attacker can exploit this to bypass policy or allowlist checks, as the host used for the policy decision may differ from the host actually resolved. This constitutes a host confusion vulnerability enabling security policy bypass. Fixed versions are 2.4.5, 3.1.6, and 4.1.3, which apply consistent host canonicalization across all resolution paths. Users are strongly advised to upgrade immediately.

Affected products

  • fast-uri 2.4.2
  • fast-uri 2.4.3
  • fast-uri 2.4.4
  • fast-uri 3.1.3
  • fast-uri 3.1.4
  • fast-uri 3.1.5
  • fast-uri 4.0.1
  • fast-uri 4.1.0
  • fast-uri 4.1.1
  • fast-uri 4.1.2

Related CVE's

  • CVE-2026-75931

Categories

  • Supply Chain & Dependencies
  • Web Technologies