Intel/AIKIDO-2026-507986
fast-uri
AIKIDO-2026-507986
fast-uri is vulnerable to Host Confusion
Host ConfusionCVE-2026-13676 Published Jul 1, 2026
75
High Risk
This Affects:
fast-uri2.3.1 - 2.4.1
Fixed in 2.4.23.0.0 - 3.1.2
Fixed in 3.1.34.0.0 - 4.0.0
Fixed in 4.0.1Are you affected? Scan for Free
TL;DR
fast-uri's host canonicalization for Unicode/IDN values was fixed to prevent security bypasses caused by inconsistent ASCII/Unicode host handling. The patch changes normalization to use WHATWG URL parsing (new URL('http://' + parsed.host).hostname) and adds tests to ensure correct ASCII/punycode outputs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
fast-uri is vulnerable to Host Confusion in versions 2.3.1 - 2.4.1, 3.0.0 - 3.1.2 and 4.0.0 - 4.0.0.
How to fix this
Upgrade the fast-uri library to the patch version.
Links
GitHub Release
Other
cna.openjsf.org/security-advisories.htmlhttps://cna.openjsf.org/security-advisories.html
access.redhat.com/errata/RHSA-2026:37186https://access.redhat.com/errata/RHSA-2026:37186
access.redhat.com/errata/RHSA-2026:37585https://access.redhat.com/errata/RHSA-2026:37585
access.redhat.com/errata/RHSA-2026:37628https://access.redhat.com/errata/RHSA-2026:37628
access.redhat.com/errata/RHSA-2026:40118https://access.redhat.com/errata/RHSA-2026:40118
access.redhat.com/errata/RHSA-2026:40262https://access.redhat.com/errata/RHSA-2026:40262
access.redhat.com/errata/RHSA-2026:40765https://access.redhat.com/errata/RHSA-2026:40765
access.redhat.com/errata/RHSA-2026:40945https://access.redhat.com/errata/RHSA-2026:40945
access.redhat.com/errata/RHSA-2026:41066https://access.redhat.com/errata/RHSA-2026:41066
access.redhat.com/errata/RHSA-2026:41928https://access.redhat.com/errata/RHSA-2026:41928
access.redhat.com/errata/RHSA-2026:41929https://access.redhat.com/errata/RHSA-2026:41929
access.redhat.com/errata/RHSA-2026:42815https://access.redhat.com/errata/RHSA-2026:42815
access.redhat.com/errata/RHSA-2026:43038https://access.redhat.com/errata/RHSA-2026:43038
access.redhat.com/errata/RHSA-2026:44239https://access.redhat.com/errata/RHSA-2026:44239
access.redhat.com/errata/RHSA-2026:44268https://access.redhat.com/errata/RHSA-2026:44268
access.redhat.com/errata/RHSA-2026:47728https://access.redhat.com/errata/RHSA-2026:47728
access.redhat.com/errata/RHSA-2026:48124https://access.redhat.com/errata/RHSA-2026:48124
access.redhat.com/errata/RHSA-2026:48126https://access.redhat.com/errata/RHSA-2026:48126
access.redhat.com/errata/RHSA-2026:49642https://access.redhat.com/errata/RHSA-2026:49642
access.redhat.com/errata/RHSA-2026:50340https://access.redhat.com/errata/RHSA-2026:50340
access.redhat.com/errata/RHSA-2026:50479https://access.redhat.com/errata/RHSA-2026:50479
access.redhat.com/errata/RHSA-2026:50758https://access.redhat.com/errata/RHSA-2026:50758
access.redhat.com/errata/RHSA-2026:51196https://access.redhat.com/errata/RHSA-2026:51196
access.redhat.com/errata/RHSA-2026:51197https://access.redhat.com/errata/RHSA-2026:51197
access.redhat.com/errata/RHSA-2026:51342https://access.redhat.com/errata/RHSA-2026:51342
access.redhat.com/errata/RHSA-2026:51348https://access.redhat.com/errata/RHSA-2026:51348
access.redhat.com/errata/RHSA-2026:51349https://access.redhat.com/errata/RHSA-2026:51349
access.redhat.com/errata/RHSA-2026:54760https://access.redhat.com/errata/RHSA-2026:54760
access.redhat.com/errata/RHSA-2026:56366https://access.redhat.com/errata/RHSA-2026:56366
access.redhat.com/errata/RHSA-2026:56431https://access.redhat.com/errata/RHSA-2026:56431
access.redhat.com/errata/RHSA-2026:57013https://access.redhat.com/errata/RHSA-2026:57013
access.redhat.com/errata/RHSA-2026:57191https://access.redhat.com/errata/RHSA-2026:57191
access.redhat.com/errata/RHSA-2026:57194https://access.redhat.com/errata/RHSA-2026:57194
access.redhat.com/errata/RHSA-2026:57590https://access.redhat.com/errata/RHSA-2026:57590
access.redhat.com/security/cve/CVE-2026-13676https://access.redhat.com/security/cve/CVE-2026-13676
bugzilla.redhat.com/show_bug.cgi?id=2494197https://bugzilla.redhat.com/show_bug.cgi?id=2494197
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.jsonhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
Resources
Industries
Use Cases
Compare
Subscribe
Stay up to date with all updates
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
© 2026 Aikido Security BV | BE0792914919
Keizer Karelstraat 15, 9000, Ghent, Belgium
95 Third St, 2nd Fl, San Francisco, CA 94103, US
Unit 6.15 Runway East 18 18 Crucifix Ln, London SE1 3JW UK
Ghent, Belgium | San Francisco, US
SOC 2Compliant
ISO 27001Compliant