fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

影響: npm:fast-uri >= 2.4.2, < 2.4.8 → 2.4.8, npm:fast-uri >= 3.1.3, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.1, < 4.2.3 → 4.2.3

fast-uri versions >= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser…

在 GitHub Advisory Database 阅读

2026/10/24 06:37，GitHub Advisory Database 发布了“fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-110180。