Description
fast-uri versions >= 2.4.2, <= 2.4.7, >= 3.1.3, <= 3.1.8, and >= 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.1, < 4.2.3 >= 3.1.3, < 3.1.9 >= 2.4.2, < 2.4.8** Patched version(s): **4.2.3 3.1.9 2.4.8**
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to host confusion via failed IDN canonicalization - CVE-2026-13676
- fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - CVE-2026-75931
- fast-uri vulnerable to host confusion via percent-encoded scheme normalization - CVE-2026-76172
- fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority - CVE-2026-84394
You might also like:
See something that needs correcting? Let us knowUpdated October 23, 2026