Overview
About vulnerability
Impact
fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything after it fold into the path. Node’s native WHATWG URL (used by fetch(), undici, and Node’s http/https clients) instead treats \ as interchangeable with / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input.
For example, fast-uri resolves \\evil.com/path against base https://allowed.com/ to https://allowed.com/%5C%5Cevil.com/path (confined to the trusted host), while Node’s WHATWG URL resolves the same reference to https://evil.com/path.
Applications that use fast-uri to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node’s URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination.
Patches
Upgrade to fast-uri v4.1.2, v3.1.5, v2.4.4.
Workarounds
None. Upgrade to the patched version.
Details
- Affected product:
- AngularJS , Fastify , Node.js , React , Vue , ajv , ajv-compiler , ajv-draft-04 , ajv-errors , ajv-formats , ajv-keywords , api-extractor-model , babel-loader , cache-loader , css-loader , css-minimizer-webpack-plugin , devkit , esbuild-loader , extract-css-chunks-webpack-plugin , fast-json-stringify , fast-json-stringify-compiler , fast-uri , file-loader , fork-ts-checker-webpack-plugin , friendly-errors-webpack-plugin , hard-source-webpack-plugin , html-webpack-plugin , light-my-request , mini-css-extract-plugin , minimizer-webpack-plugin , nuxt , optimize-css-assets-webpack-plugin , postcss-loader , rushstack , schema-utils , style-resources-loader , table , thread-loader , time-fix-plugin , ts-command-line , tsdoc , url-loader , webpack , webpack-dev-middleware , webpack-dev-server , webpackbar , worker-loader
- Affected packages:
- fast-uri @ 3.1.3 (+464 more)