Description
fast-uri versions >= 2.3.1, <= 4.0.0 fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls URL.domainToASCII(...) on the global WHATWG URL constructor, where that helper does not exist. The resulting TypeError is silently routed into parsed.error, but parse(), normalize(), and equal() all return with the host left in its original Unicode form.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 2.3.1, < 2.4.2 >= 3.0.0, < 3.1.3 >= 4.0.0, < 4.0.1** Patched version(s): **2.4.2 3.1.3 4.0.1**
References
- GHSA-4c8g-83qw-93j6
- security.access.redhat.com
- cna.openjsf.org
- bugzilla.redhat.com
- access.redhat.com
- CVE-2026-13676
- CWE-436
- CWE-551
- CAPEC-310
- OWASP 2021-A6
Related Issues
- fast-uri vulnerable to host confusion via literal backslash authority delimiter - CVE-2026-16221
- fast-uri vulnerable to host confusion via backslash authority introducer - CVE-2026-18446
- fast-uri vulnerable to host confusion via percent-encoded authority delimiters - CVE-2026-6322
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
You might also like:
- Tags:
- npm
- fast-uri
Anything's wrong? Let us know Last updated on August 14, 2026