CVE-2026-86472: fast-uri Vulnerable to Inconsistent Host Case Normalization via Percent-Encoded Octets
Summary
CVE-2026-86472: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets. Affects fast-uri across 3 version ranges.
< 2.4.7
>= 3.0.0, < 3.1.8
>= 4.0.0, < 4.1.5
Fixed in 2.4.7, 3.1.8 or 4.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-uri is a popular npm package used for parsing and manipulating URIs. It provides functionality to handle various URI components, ensuring that they are correctly formatted and normalized. However, it has a vulnerability that allows for inconsistent case handling of hostnames, which can lead to security issues when applications make case-sensitive decisions based on parsed URIs.
Vulnerability Detail
The vulnerability arises because fast-uri converts the host to lowercase before percent-decoding it. This means that a percent-encoded uppercase octet, such as '%41', decodes to 'A', which is not folded to lowercase. Consequently, when comparing scheme-relative references, the parsed output can yield inconsistent results. For example, 'parse("//%41.com").host' returns 'A.com', while 'parse("//a.com").host' and 'parse("//A.com").host' return 'a.com'. This inconsistency can lead to bypassing security checks that rely on case-sensitive comparisons, allowing malicious actors to evade host allowlists or denylists.
How To Fix
Latest published version: 4.2.3 as of 22 Oct 2026
npm install fast-uri@4.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.72.4.7npm install fast-uri@2.4.7 -
>= 3.0.0, < 3.1.83.1.8npm install fast-uri@3.1.8 -
>= 4.0.0, < 4.1.54.1.5npm install fast-uri@4.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any host comparisons are done case-insensitively. You can achieve this by converting the parsed host to lowercase before making any allowlist or denylist decisions. For example:
const fastUri = require('fast-uri');
const url = '//%41.com';
const parsedHost = fastUri.parse(url).host.toLowerCase();
// Now use parsedHost for any comparisons.
Conclusion
The fast-uri package has a vulnerability that affects how it handles case normalization of hostnames in URIs. By upgrading to the patched versions or implementing the suggested workaround, users can mitigate the risks associated with this vulnerability. Regular monitoring and updates are essential to maintain the security of applications.
See every vulnerability recorded for fast-uri →
FAQ
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to security checks being bypassed, allowing unauthorized access to resources based on case-sensitive host decisions.
If an immediate upgrade is not possible, implement the suggested workaround to ensure case-insensitive host comparisons.
You can find more information about fast-uri on its npm page or GitHub repository, where you can also view the source code and documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-uri.
