CVE-2026-86472: fast-uri Authentication Bypass Vulnerability

CVE-2026-86472 Overview

CVE-2026-86472 affects fast-uri, a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv. The parser folds the host to lowercase before percent-decoding, so a percent-encoded uppercase octet such as %41 decodes to a literal A that never gets normalized. For scheme-relative references like //host, host canonicalization does not run, so parse, normalize, and equal disagree on the same host. Applications that make case-sensitive host decisions on the parsed output can be steered past allowlist or denylist checks.

Critical Impact
An attacker can craft a URI with a percent-encoded uppercase host octet to bypass case-sensitive host allowlists or denylists, then still reach the intended host because DNS and HTTP treat hostnames case-insensitively.

Affected Products

fast-uri versions before 2.4.7
fast-uri versions 3.0.0 through 3.1.7
fast-uri versions 4.0.0 through 4.1.4

Discovery Timeline

2026-09-15 - CVE-2026-86472 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-86472

Vulnerability Analysis

The flaw is an incorrect case-sensitivity handling issue tracked as CWE-178. fast-uri executes host lowercasing before percent-decoding, which inverts the correct order defined by RFC 3986 normalization. A percent-encoded uppercase octet survives the lowercase step and decodes into an uppercase literal in the parsed host field.

For scheme-relative references such as //EXAMPLE.com written as //%45XAMPLE.com, the parser never applies the scheme-triggered canonicalization pass. This produces divergent output across the parse, normalize, and equal APIs for what is functionally the same DNS name.

Downstream code that compares the parsed host against an allowlist or denylist using case-sensitive equality accepts the mixed-case decoded value as distinct from the canonical entry. DNS resolution and HTTP host matching remain case-insensitive, so traffic still reaches the intended host.

Root Cause

The root cause is operation order in the host normalization pipeline. Lowercasing runs before percent-decoding, and the scheme-relative code path skips the canonicalization repair that would otherwise reconcile the two representations.

Attack Vector

Exploitation requires an application that consumes fast-uri output for a host-based security decision and compares the host without lowercasing. An attacker submits a URL containing a percent-encoded uppercase octet in the host component. The check compares the decoded mixed-case host against a canonical lowercase entry and fails to match a denylist or match an allowlist entry the attacker aimed to reach. See the GitHub Fastify Security Advisory for the maintainer analysis.

No verified exploit code is publicly available. The vulnerability mechanism is described in prose per the referenced advisory.

Detection Methods for CVE-2026-86472

Indicators of Compromise

Inbound requests containing percent-encoded alphabetic octets in the host component of a URL, for example %41 through %5A or %61 through %7A.
Application logs showing successful requests to hosts that should have been blocked by an allowlist or denylist policy.
Scheme-relative URI inputs (//host/path) submitted to endpoints that perform host validation.

Detection Strategies

Inventory Node.js dependencies for fast-uri versions matching the vulnerable ranges using npm ls fast-uri or Software Bill of Materials (SBOM) tooling.
Search application code for calls to fast-uriparse, normalize, or equal where results feed host-based authorization logic.
Deploy web application firewall rules that flag or reject URIs containing percent-encoded alphabetic characters in the authority component.

Monitoring Recommendations

Log parsed host values alongside the original raw URI to identify mismatches between attacker input and normalized output.
Alert on repeated allowlist or denylist misses that resolve to hosts already present in policy tables when compared case-insensitively.
Track upstream Fastify and ajv release notes for transitive fast-uri updates in service dependency chains.

How to Mitigate CVE-2026-86472

Immediate Actions Required

Upgrade fast-uri to version 2.4.7, 3.1.8, 4.1.5, or later depending on the major branch in use.
Audit application code paths that use fast-uri output for host allowlist or denylist decisions.
Update transitive dependencies by refreshing package-lock.json after Fastify and ajv publish releases pinning the fixed versions.

Patch Information

The maintainers fixed the flaw in fast-uri 2.4.7, 3.1.8, and 4.1.5. Details are published in the GitHub Fastify Security Advisory and the OpenJS Foundation Security Advisories.

Workarounds

Lowercase the parsed host explicitly before any allowlist or denylist comparison, for example host.toLowerCase().
Use case-insensitive comparison functions such as String.prototype.localeCompare with the sensitivity: 'base' option for host checks.
Reject URIs at the ingress layer when the authority component contains percent-encoded alphabetic octets.

bash

# Configuration example
npm install fast-uri@^4.1.5
npm ls fast-uri