Skip to content
OpenAdvisories

Description

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.

Affected products

VendorProductAffectedFixed
fast-uri fast-uri 4.0.0 – < 4.1.2, 3.0.0 – < 3.1.5, < 2.4.4 4.1.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-ajv 8.20.0~ds+~cs7.1.3-1 —
Debian 13 node-ajv No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-ajv No fix yet —
Ubuntu 26.04 LTS node-ajv No fix yet —
Ubuntu 24.04 LTS node-ajv No fix yet —
Ubuntu 22.04 LTS node-ajv No fix yet —
Ubuntu 20.04 LTS node-ajv No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS node-ajv No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 grafana12.4 12.4.6-0.3.hum1 RHSA-2026:49401
Red Hat Hardened Images 1 grafana13.1 13.1.1-0.4.hum1 RHSA-2026:49387

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling argo-workflows-ui-4.0 4.0.8-r2 —
Wolfi rolling jupyter-base-notebook 7.6.3-r2 —
Wolfi rolling langfuse-3 +1 3.225.1-r2 —
Wolfi rolling langfuse-3-compat 3.225.7-r6 —
Wolfi rolling opensearch-dashboards-3 3.7.0-r12 —
Wolfi rolling prism 5.16.0-r4 —
Wolfi rolling renovate 44.23.3-r0 —
Wolfi rolling saf 1.6.0-r4 —
Wolfi rolling serve 14.2.6-r5 —
Wolfi rolling vitess-24 24.0.2-r10 —
Wolfi rolling vitess-24-compat 24.0.3-r7 —
Wolfi rolling yaml-language-server 1.24.0-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm fast-uri < 2.4.4 2.4.4 GHSA-7p8r-x3mc-p8w7
npm fast-uri >= 3.0.0, < 3.1.5 3.1.5 GHSA-7p8r-x3mc-p8w7
npm fast-uri >= 4.0.0, < 4.1.2 4.1.2 GHSA-7p8r-x3mc-p8w7

Advisories 5

References