Overview
About vulnerability
Impact
fast-uri v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node’s native WHATWG URL (used by fetch(), undici, and Node’s http/https clients) normalizes \ to / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input string.
For example, http://evil.com\@allowed.com is treated by fast-uri as host allowed.com with userinfo evil.com\, while Node’s WHATWG URL parser and fetch() see host evil.com with path /@allowed.com.
Applications that use fast-uri to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node’s URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.
Patches
Upgrade to fast-uri v4.1.1, v3.1.4, or v2.4.3.
Workarounds
None. Upgrade to the patched version.
Details
- Affected product:
- Angular , AngularJS , Fastify , Lodash , Next.js , Node.js , React , Vue , adk-js , ajv , ajv-compiler , ajv-draft-04 , ajv-errors , ajv-formats , ajv-i18n , ajv-keywords , algokit-utils-ts , allure-js , angular-devkit-schematics-cli , angular-eslint-builder , api-extractor-model , apideck-better-ajv-errors , apidom , apify-json_schemas , apollo , apollo-server , appium , appium-execute-driver-plugin , appium-fake-driver , appium-fake-plugin , appium-relaxed-caps-plugin , astro , automatic-vendor-sharing , awesome-ajv-errors , babel-loader , better-ajv-errors , build , cache-loader , clawdbot-lobster , clean-webpack-plugin , cloudevents , codeceptjs , commitlint , conf , config , configure , confluent-kafka-javascript , connect-es , copy-webpack-plugin , core , css-loader , css-minimizer-webpack-plugin , db0 , devframe , devkit , devtools , docusaurus , docusaurus-babel , docusaurus-bundler , docusaurus-core , docusaurus-mdx-loader , docusaurus-module-type-aliases , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-search-algolia , docusaurus-types , docusaurus-utils , docusaurus-utils-common , docusaurus-utils-validation , drizzle-orm , ecosystem , ember-auto-import , esbuild-loader , eslint , eslint-config-ipfs , eslint-config-love , eslint-config-standard , eslint-etc , eslint-mcp , eslint-plugin-es , eslint-plugin-etc , eslint-plugin-import , eslint-plugin-jsdoc , eslint-plugin-node , eslint-plugin-promise , eslint-plugin-react , eslint-utils , expo , ext-apps , extract-css-chunks-webpack-plugin , fast-json-stringify , fast-json-stringify-compiler , fast-uri , file-loader , fork-ts-checker-webpack-plugin , friendly-errors-webpack-plugin , gateway , google-cloud-functions-framework , google-cloud-vertexai , graphql-codegen-typescript-jit-sdk , graphql-hive-envelop , graphql-hive-gateway , graphql-jit , graphql-mesh , graphql-mesh-cli , graphql-mesh-config , graphql-mesh-migrate-config-cli , hard-source-webpack-plugin , hooks , html-loader , html-webpack-plugin , html-webpack-tags-plugin , impound , jest-expect-jsonschema , js-genai , json-render , language-server , less-loader , light-my-request , mastra , mastra-mcp , mastra-observability , mdx , metamask-snaps-cli , microsoft-365-agents-toolkit , middleware , middy , mini-css-extract-plugin , minimizer-webpack-plugin , modern.js , module-federation-core , module-federation/core , monorepo , mui-x-telemetry , nest , netlify-build , netlify-cms , netlify-cms-app , netlify-cms-core , netlify-dev , netlify-edge-functions , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , ng-packagr , nitro , nostics , null-loader , nuxt , oas , oas-normalize , office-addin-manifest , office-addin-scripts , openai-agents-js , optimize-css-assets-webpack-plugin , orval , pdfjs-dist , pkgs , postcss-loader , prefresh-webpack , primitives , prisma , progress-bar-webpack-plugin , progress-webpack-plugin , readme-better-ajv-errors , readme-openapi-parser , redocly-ajv , redocly-cli , redocly-client-generator , rollup-plugin-workbox , rsbuild , rsbuild-core , rsbuild-plugin-css-minimizer , rsdoctor , rsdoctor-core , rsdoctor-graph , rsdoctor-rspack-plugin , rsdoctor-sdk , rsdoctor-types , rsdoctor-utils , rushstack , rushstack-hashed-folder-copy-plugin , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-webpack5-localization-plugin , rushstack-webpack5-module-minifier-plugin , sass-loader , scalar , scalar-openapi-parser , scalar/scalar , schema-utils , schematics , sdk-typescript , services , sidvind-better-ajv-errors , silverbucket/ajv-formats-draft2019 , size-plugin , soda-friendly-errors-webpack-plugin , source-map-loader , storybook-addon-webpack5-compiler-swc , streams , style-loader , style-resources-loader , stylelint , stylelint-no-unsupported-browser-features , stylelint-scss , svg-url-loader , swagger-parser , table , telemetry , thread-loader , time-fix-plugin , transloadit-mcp-server , ts-command-line , ts-loader , tsdoc , tsup , typescript-eslint , typescript-sdk , uglifyjs-webpack-plugin , unctx , unimport , unocss , unocss-unocss , unplugin , unstorage , url-loader , verdaccio , vite , vite-dev-rpc , vite-hot-client , vite-plugin-checker , vite-plugin-inspect , vite-plugin-react , vite-plugin-vue , vite-plugin-vue-inspector , vite-plugin-vue-tracer , vitefu , web-infra-dev/modern.js , webpack , webpack-assets-manifest , webpack-cli , webpack-cli-configtest , webpack-cli-generators , webpack-cli-info , webpack-cli-serve , webpack-dev-middleware , webpack-dev-server , webpack-subresource-integrity , webpackbar , workbox , worker-loader , wyw-in-js , x402 , xhd-wallet-api-ts , yaml-language-server , zephyr-packages
- Affected packages:
- fast-uri @ 2.4.0 (+2599 more)