AIKIDO-2026-24343
fast-uri is vulnerable to Host Confusion
75
High Risk
This Affects:
fast-uriTL;DR
The resolve() function does not canonicalize the host to ASCII form when processing scheme-relative references that begin with // against a scheme-bearing base URI. Because canonicalization only runs when the input itself carries a scheme, the effective host after resolution can differ from the value an application inspects. Code that validates or routes on the resolved host can approve one host while requests reach another. The fix canonicalizes the host once the effective scheme becomes known during resolution.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application resolves untrusted or externally influenced references and then validates or routes on the resulting host.
Background info
fast-uri is vulnerable to Host Confusion in versions 2.4.2 - 2.4.4, 3.1.3 - 3.1.5 and 4.0.1 - 4.1.2.
How to fix this
Upgrade the fast-uri library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant