CVE-2026-13676: Openjsf Fast-uri Auth Bypass Vulnerability

CVE-2026-13676 Overview

CVE-2026-13676 affects the fast-uri Node.js package maintained under the OpenJS Foundation. Versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode Internationalized Domain Name (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, so the host remains in its original Unicode form while normalize() and equal() return values inconsistent with a WHATWG-compatible URL parser. Applications that use fast-uri for host-based policy enforcement before passing the same URL to Node's URL or fetch can be bypassed when the two parsers resolve the same input to different hosts.

Critical Impact
Attackers can bypass denylists, loopback filters, redirect validation, and outbound proxy routing controls, enabling server-side request forgery and policy evasion against services relying on fast-uri for host validation.

Affected Products

fast-uri versions 2.3.1 through 3.1.2 (Node.js)
fast-uri version 4.0.0 (Node.js)
Applications using fast-uri for host-based security policy enforcement

Discovery Timeline

2026-06-29 - CVE-2026-13676 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13676

Vulnerability Analysis

The vulnerability stems from a parser differential between fast-uri and the WHATWG URL implementation used by Node.js. When fast-uri processes a URL containing a non-ASCII (IDN) hostname, the IDN conversion path invokes a helper method that does not exist on the global URL constructor. The call silently fails, and fast-uri returns the host in its original Unicode form. Downstream calls to normalize() and equal() produce values that diverge from what Node URL or fetch would resolve.

This creates a classic time-of-check to time-of-use gap. Security logic evaluates one host representation, while the actual network request resolves a different host. Applications that use fast-uri to enforce denylists, loopback filtering, redirect validation, or outbound proxy routing can be bypassed. The issue maps to [CWE-436] Interpretation Conflict and [CWE-551] Incorrect Behavior Order: Authorization Before Parsing Canonicalization.

Root Cause

The fast-uri IDN normalization routine depends on a helper function assumed to be present on the platform URL constructor. The helper is absent, and the failure is not surfaced as an error. Instead, the parser returns the raw Unicode host, producing a canonicalization outcome that disagrees with any WHATWG-compliant parser used later in the same request pipeline.

Attack Vector

An attacker submits a URL with a Unicode hostname that visually or logically maps to a restricted target such as localhost, an internal service, or a denylisted domain. The application parses the URL with fast-uri, applies host-based policy checks against the un-normalized Unicode host, and passes validation. The application then hands the same URL to fetch or http.request, which resolves the IDN host to its Punycode ASCII form and issues a request to the sensitive target. See the GitHub Security Advisory GHSA-4c8g-83qw-93j6 for full technical details.

Detection Methods for CVE-2026-13676

Indicators of Compromise

Outbound HTTP requests from application servers to internal IP ranges (RFC1918, 127.0.0.0/8, 169.254.169.254) following user-supplied URL input
Web server access logs containing URLs with non-ASCII hostname characters or xn-- Punycode prefixes routed through validation endpoints
Discrepancies between logged validated hostnames and DNS resolution logs for the same request identifier

Detection Strategies

Inventory Node.js applications for the fast-uri dependency using npm ls fast-uri or Software Bill of Materials (SBOM) tooling and flag versions 2.3.1 through 3.1.2 and 4.0.0
Add application-layer logging that records both the fast-uri-parsed host and the eventual URL-parsed host to identify divergence in production traffic
Monitor Server-Side Request Forgery (SSRF) telemetry for outbound connections to metadata services or internal hostnames originating from URL-handling code paths

Monitoring Recommendations

Correlate egress network telemetry with application URL validation logs to detect parser-differential exploitation
Alert on any resolved outbound host that differs from the host string presented to policy enforcement code
Track dependency updates to fast-uri across build pipelines and fail builds on vulnerable versions

How to Mitigate CVE-2026-13676

Immediate Actions Required

Upgrade fast-uri to version 3.1.3 for the 3.x line or 4.0.1 for the 4.x line
Audit all code paths where fast-uri output feeds host-based security decisions such as SSRF filters, redirect validators, or proxy routing
Rebuild and redeploy any Node.js services with the pinned patched version and refresh lockfiles

Patch Information

The maintainers released fixed versions fast-uri@3.1.3 and fast-uri@4.0.1. Refer to the OpenJS Foundation Security Advisories and Red Hat CVE-2026-13676 for distribution-specific guidance and the Red Hat VEX Document for affected product status.

Workarounds

Enforce host-based policy using the same URL parser that issues the eventual network request, eliminating the parser differential
Reject non-ASCII hostnames before policy checks by validating that the host contains only ASCII characters or is already in Punycode (xn--) form
Where feasible, allowlist known-good hostnames rather than denylisting internal targets, reducing exposure to canonicalization bypasses

bash

# Upgrade fast-uri to a patched release
npm install fast-uri@^3.1.3
# or for the 4.x line
npm install fast-uri@^4.0.1

# Verify no vulnerable versions remain in the dependency tree
npm ls fast-uri