Description
fast-uri versions >= 2.3.1, <= 4.0.0 fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls URL.domainToASCII(...) on the global WHATWG URL constructor, where that helper does not exist. The resulting TypeError is silently routed into parsed.error, but parse(), normalize(), and equal() all return with the host left in its original Unicode form.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 2.3.1, < 2.4.2 >= 3.0.0, < 3.1.3 >= 4.0.0, < 4.0.1** Patched version(s): **2.4.2 3.1.3 4.0.1**
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to host confusion via failed IDN canonicalization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to host confusion via literal backslash authority delimiter - CVE-2026-16221
- fast-uri vulnerable to host confusion via backslash authority introducer - CVE-2026-18446
- fast-uri vulnerable to host confusion via percent-encoded authority delimiters - CVE-2026-6322
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
You might also like:
See something that needs correcting? Let us knowUpdated August 14, 2026