CVE-2026-75931: fast-uri Auth Bypass Vulnerability

CVE-2026-75931 Overview

CVE-2026-75931 is a host confusion vulnerability in fast-uri, a Uniform Resource Identifier (URI) parser for Node.js maintained by the Fastify project. The library canonicalizes the host to its ASCII form only when the input contains an explicit scheme. Scheme-relative references, such as inputs beginning with two forward slashes, are returned with the host verbatim. As a result, parse, resolve, normalize, and equal disagree on the host for the same input. Applications that check a parsed host against an allowlist and then resolve the same reference may authorize one host while requests reach another. This enables policy bypass and Server-Side Request Forgery (SSRF)-style routing to unintended destinations.

Critical Impact
Inconsistent host canonicalization allows attackers to bypass host-based policy checks and redirect requests to attacker-controlled destinations.

Affected Products

fast-uri versions 2.4.2 up to but not including 2.4.5
fast-uri versions 3.1.3 up to but not including 3.1.6
fast-uri versions 4.0.1 up to but not including 4.1.3

Discovery Timeline

2026-08-24 - CVE-2026-75931 published to the National Vulnerability Database (NVD)
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-75931

Vulnerability Analysis

The flaw is classified under [CWE-436] Interpretation Conflict. fast-uri exposes multiple entry points that interpret the same URI differently. When a caller passes an absolute URI containing a scheme such as https://EXAMPLE.com/path, the parser lowercases and canonicalizes the host to ASCII. When the same reference is passed without a scheme, for example //EXAMPLE.com/path, the parser returns the host as written and sets no error.

This inconsistency spans parse, resolve, normalize, and equal. The equal function can return opposite verdicts for the same pair of hosts depending on whether a scheme is included. A downstream security decision that uses one entry point and forwards the reference to another cannot rely on the parsed host matching the destination host.

Root Cause

Host canonicalization is applied only along the absolute-URI code path. Scheme-relative and relative reference resolution paths skip the ASCII conversion step that lowercases the host and applies Internationalized Domain Names in Applications (IDNA) processing. The result is two representations of the same authority: a canonical form for parsed absolute URIs and a raw form for resolved references.

Attack Vector

An attacker supplies a scheme-relative reference whose host, after canonicalization, resolves to a target the application intends to block. The application parses the input, extracts a host string that differs from the canonical form, and matches that string against its policy list. The policy check passes. The application then calls resolve or issues an HTTP request using the same reference, and the traffic is directed to the attacker-chosen host. The attack requires no authentication and no user interaction, and can be performed remotely over the network.

The vulnerability is described in prose rather than code because no verified proof-of-concept is published. Refer to the GitHub Security Advisory GHSA-5jgf-p345-68v8 for maintainer detail.

Detection Methods for CVE-2026-75931

Indicators of Compromise

Inbound requests containing scheme-relative URIs (payloads beginning with //) submitted to endpoints that accept URLs or callback parameters.
Application logs where the host parsed by fast-uri differs in case or Punycode form from the host reached by the outbound HTTP client.
Outbound connections from services that use fast-uri targeting hosts absent from the intended allowlist.

Detection Strategies

Inventory Node.js projects and their transitive dependencies for fast-uri versions listed in the affected ranges using npm ls fast-uri or Software Composition Analysis (SCA) tooling.
Add unit tests that call parse, resolve, normalize, and equal on scheme-relative inputs and assert consistent host output.
Monitor egress traffic for connections that do not match the destinations logged by application-level allowlist checks.

Monitoring Recommendations

Correlate parsed host values with resolved request destinations in application telemetry to detect drift.
Alert on Domain Name System (DNS) resolutions from application workloads to hosts outside the approved destination set.
Track package-lock.json and yarn.lock changes in continuous integration pipelines to catch regressions to vulnerable versions.

How to Mitigate CVE-2026-75931

Immediate Actions Required

Upgrade fast-uri to 2.4.5, 3.1.6, or 4.1.3 depending on the major version in use.
Audit application code paths that call fast-uri for host-based authorization decisions and confirm the parsed host equals the destination host.
Rebuild and redeploy container images and serverless bundles that ship the vulnerable versions.

Patch Information

The Fastify maintainers fixed the issue by canonicalizing the host consistently across the resolve path. Fixed releases are 2.4.5, 3.1.6, and 4.1.3. See the GitHub Security Advisory GHSA-5jgf-p345-68v8 and the OpenJSF Security Advisories index for the coordinated disclosure record.

Workarounds

Reject inputs that begin with // before passing them to fast-uri when a scheme is expected.
Normalize hosts independently using a Web Hypertext Application Technology Working Group (WHATWG) URL parser and compare against the value returned by fast-uri before applying policy.
Enforce allowlists at the network egress layer so that policy decisions do not rely solely on parsed host strings.

bash

# Configuration example
npm install fast-uri@^4.1.3
npm ls fast-uri