CVE-2026-86472
Received Received - Intake

URI Host Parsing Bypass in fast-uri

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: openjs

Description
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-86472
EUVD
EUVD-2026-78395

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
fast_uri fast_uri 2.4.7
fast_uri fast_uri 3.1.8
fast_uri fast_uri 4.1.5
fast_uri fast_uri From 3.0.0 (inc) to 3.1.7 (inc)
fast_uri fast_uri From 4.0.0 (inc) to 4.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the fast-uri library used in Node.js applications. It occurs when the library converts the host to lowercase before decoding percent-encoded characters. This causes uppercase unreserved octets like %41 to decode to literal uppercase letters, bypassing lowercase normalization. As a result, functions like parse, normalize, and equal produce inconsistent results for scheme-relative references such as //host.

Detection Guidance

To detect this vulnerability, check the version of fast-uri in your Node.js project using commands like 'npm list fast-uri' or 'npm ls fast-uri'. If the version is before 2.4.7, between 3.0.0-3.1.7, or between 4.0.0-4.1.4, the system is vulnerable.

Impact Analysis

An attacker could exploit this to bypass case-sensitive host checks, such as allowlists or denylists, by using percent-encoded uppercase octets. Since hostnames are case-insensitive in DNS and HTTP, the evasion still reaches the intended host. This could allow unauthorized access to restricted hosts or bypass security controls.

Mitigation Strategies

Immediately upgrade fast-uri to version 2.4.7, 3.1.8, or 4.1.5 or later. As a temporary workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86472. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart