AIKIDO-2026-805855
fast-uri is vulnerable to Improper Input Validation
75
High Risk
This Affects:
fast-uriTL;DR
canonicalizeHost skips IDN when the host starts with [, while parse() only treats a host as a bracketed IP literal (and flags malformed literals) when both [ and ] are present — unbalanced bracket hosts therefore diverge across parse(), normalize(), equal(), and resolve(). Code that trusts one of these functions to reject a dangerous host can be bypassed by a peer that crafts a mismatched bracket. The fix requires both a leading [ and a trailing ] before any function treats a host as an IP literal.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on parse, normalize, equal, or resolve to consistently validate or compare a URI whose host may contain an IP-literal bracket.
Background info
fast-uri is vulnerable to Improper Input Validation in versions 2.4.5 - 2.4.5, 3.1.6 - 3.1.6 and 4.1.3 - 4.1.3.
How to fix this
Upgrade the fast-uri library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.