{"id":"GHSA-5jgf-p345-68v8","summary":"fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references","details":"### Impact\n\n`fast-uri` canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When `resolve()` resolves a scheme-relative reference (`//host/`) against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved URI yields a different host than the one `resolve()` returned. An application that resolves an untrusted reference with `fast-uri` and then checks or routes on the resulting host can make a policy decision on one host and reach another. This is an incomplete-fix variant of CVE-2026-13676, whose IDN canonicalization was applied only to the scheme-bearing form.\n\n### Patches\n\nUpgrade to `fast-uri` 2.4.5, 3.1.6, or 4.1.3. `resolve()` now canonicalizes the host once the effective scheme is known, and fails closed if a raw non-ASCII host cannot be converted.\n\n### Workarounds\n\nResolve scheme-relative references against a base that carries a scheme before performing any host-policy or origin check.","aliases":["CVE-2026-75931"],"modified":"2026-09-02T16:00:13.939876995Z","published":"2026-09-02T15:44:30Z","database_specific":{"nvd_published_at":"2026-08-24T10:16:40Z","cwe_ids":["CWE-436"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-09-02T15:44:30Z"},"references":[{"type":"WEB","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75931"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/fastify/fast-uri"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.5"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.6"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.3"}],"affected":[{"package":{"name":"fast-uri","ecosystem":"npm","purl":"pkg:npm/fast-uri"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.2"},{"fixed":"2.4.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5jgf-p345-68v8/GHSA-5jgf-p345-68v8.json"}},{"package":{"name":"fast-uri","ecosystem":"npm","purl":"pkg:npm/fast-uri"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.3"},{"fixed":"3.1.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5jgf-p345-68v8/GHSA-5jgf-p345-68v8.json"}},{"package":{"name":"fast-uri","ecosystem":"npm","purl":"pkg:npm/fast-uri"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.1"},{"fixed":"4.1.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5jgf-p345-68v8/GHSA-5jgf-p345-68v8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}