fast-uri IDN Hostname Canonicalization Bypass

Executive Summary

The vulnerability exists in fast-uri versions 2.3.1 through 3.1.2 and 4.0.0, where the library fails to properly canonicalize Unicode (IDN) hostnames for HTTP-family URLs. This happens because a helper function expected by the global WHATWG URL constructor is missing, causing the host to remain in its original Unicode form instead of being normalized.

As a result, functions like normalize() and equal() return values that differ from those of a WHATWG-compatible URL parser such as Node's URL or fetch. This discrepancy can cause applications that use fast-uri to enforce host-based policies (like denylists, loopback filtering, redirect validation, or outbound proxy routing) to be bypassed, since the same URL input resolves to different hosts depending on the parser used.

The issue has been patched in fast-uri versions 3.1.3 and 4.0.1.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in fast-uri causes discrepancies in hostname canonicalization, which can lead to bypassing host-based policies such as denylists, loopback filtering, redirect validation, and outbound proxy routing. This can result in unintended destinations being accessed or unauthorized network communications occurring.

Such behavior may impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data access, transmission, and security policies. If host-based policies are bypassed, it could lead to unauthorized data exposure or transmission, violating confidentiality and integrity requirements mandated by these regulations.

To mitigate these risks and maintain compliance, it is recommended to upgrade fast-uri to patched versions (3.1.3 or 4.0.1) or enforce host policies using the same URL parser as the actual request, or reject non-ASCII hosts before policy checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to bypass host-based security policies enforced by applications using fast-uri. Because fast-uri does not canonicalize Unicode hostnames correctly, URLs that should be blocked or filtered might be accepted, leading to unintended destinations.

Such bypasses can affect denylists, loopback filtering, redirect validation, and outbound proxy routing, potentially allowing malicious URLs to evade security controls.

The CVSS score of 7.5 indicates a high severity with an integrity impact, meaning attackers can cause incorrect behavior without needing privileges or user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves fast-uri failing to canonicalize Unicode (IDN) hostnames properly, causing discrepancies between fast-uri and Node's WHATWG URL parser. Detection involves identifying URLs where the hostnames remain in Unicode form instead of being normalized to ASCII.

To detect this on your system, you can test URLs with Unicode hostnames using fast-uri's parse() or normalize() functions and compare the results with Node's built-in URL parser or fetch(). If the hostnames differ, the vulnerability may be present.

• Use a script or command to parse a URL with Unicode hostnames using fast-uri and Node's URL parser, then compare the outputs.
• Example Node.js commands:
• 1. Parse URL with fast-uri: `const fastUri = require('fast-uri'); console.log(fastUri.parse('http://127。0。0。1/'));`
• 2. Parse URL with Node's URL parser: `console.log(new URL('http://127。0。0。1/').host);`
• If fast-uri returns the host in Unicode form (e.g., '127。0。0。1') but Node's URL parser returns the ASCII normalized form (e.g., '127.0.0.1'), the vulnerability exists.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading fast-uri to a patched version and applying workarounds to avoid policy bypass.

• Upgrade fast-uri to version 3.1.3 if using the 3.x line or 4.0.1 if using the 4.x line, where the vulnerability is patched.
• Enforce host-based policies using the same URL parser that will be used for the actual request, such as Node's WHATWG URL parser, to avoid discrepancies.
• Alternatively, reject URLs with non-ASCII hostnames before performing policy checks to prevent bypass.

Useful 0 Not Useful 0