Description
fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference (//host) there is no scheme, so the host canonicalization that repairs this on a scheme-bearing URL does not run.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 4.1.5 >= 3.0.0, < 3.1.8 < 2.4.7** Patched version(s): **4.1.5 3.1.8 2.4.7**
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to host confusion via percent-encoded scheme normalization - CVE-2026-76172
- fast-uri vulnerable to host confusion via percent-encoded authority delimiters - CVE-2026-6322
- fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding - CVE-2026-110306
- fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization - CVE-2026-86818
You might also like:
See something that needs correcting? Let us knowUpdated September 29, 2026