fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

影響: npm:fast-uri >= 2.4.2, < 2.4.8 → 2.4.8, npm:fast-uri >= 3.1.3, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.1, < 4.2.3 → 4.2.3

fast-uri versions >= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser…

GitHub Advisory Databaseで読む

2026/10/24 06:37、GitHub Advisory Databaseが「fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-110180。