fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

影響: npm:fast-uri >= 2.4.2, < 2.4.8 → 2.4.8, npm:fast-uri >= 3.1.3, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.1, < 4.2.3 → 4.2.3

fast-uri versions >= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser…

Read on GitHub Advisory Database

On 10/24/2026, 06:37 AM, GitHub Advisory Database published "fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-110180.