fast-uri vulnerable to host confusion via failed IDN canonicalization
Priority MEDIUM 40CWE-436Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 35 fixed, 16 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00692 53rd percentileScored 2026-11-07
Fix Partial fast-uri (fast-uri): 4.0.1, 3.1.3fast-uri (npm): 4.0.1, 3.1.3, 2.4.2Red Hat: 45 advisoriesRed Hat: 35 fixed, 16 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fast-uri | fast-uri | 4.0.0 to before 4.0.1; 2.3.1 to before 3.1.3 | 4.0.1, 3.1.3 | Patch available | CNA |
| — | fast-uri (npm) | 4.0.0 to before 4.0.1 | 4.0.1 | Patch available | GHSA-4c8g-83qw-93j6 |
| — | fast-uri (npm) | 3.0.0 to before 3.1.3 | 3.1.3 | Patch available | GHSA-4c8g-83qw-93j6 |
| — | fast-uri (npm) | 2.3.1 to before 2.4.2 | 2.4.2 | Patch available | GHSA-4c8g-83qw-93j6 |
- fast-uri Vendorfast-uri Affected 4.0.0 to before 4.0.1; 2.3.1 to before 3.1.3 Fixed in 4.0.1, 3.1.3 Patch available CNA
- fast-uri (npm) Vendor— Affected 4.0.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-4c8g-83qw-93j6
- fast-uri (npm) Vendor— Affected 3.0.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-4c8g-83qw-93j6
- fast-uri (npm) Vendor— Affected 2.3.1 to before 2.4.2 Fixed in 2.4.2 Patch available GHSA-4c8g-83qw-93j6
Remediation
- Fix · CNA fast-uri (fast-uri) Fixed in 4.0.1, 3.1.3
- Fix · GHSA-4c8g-83qw-93j6 fast-uri (npm) Fixed in 4.0.1 Advisory →
- Fix · GHSA-4c8g-83qw-93j6 fast-uri (npm) Fixed in 3.1.3 Advisory →
- Fix · GHSA-4c8g-83qw-93j6 fast-uri (npm) Fixed in 2.4.2 Advisory →
Red Hat 45 advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:68254 Released 2026-09-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.1 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
Show 42 more Red Hat advisories
- RHSA-2026:68006 Released 2026-09-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.1 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
- RHSA-2026:66488 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.14.1 release and security update
- Red Hat AMQ Broker 7.14.1
- RHSA-2026:63371 Released 2026-09-03 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:61314 Released 2026-08-31 · Red Hat rating ImportantCluster Observability Operator 1.5.2
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:60386 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
- RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.17.2 security update
- multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
- RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Importantrh-podman-desktop security, bug fix, and enhancement update
- Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
- RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Importantmulticluster engine for Kubernetes v2.11.5 security update
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
- RHSA-2026:57191 Released 2026-08-19 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
- RHSA-2026:57013 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:56366 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:54760 Released 2026-08-13 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:50758 Released 2026-08-12 · Red Hat rating CriticalOpenShift Container Platform 4.16.68 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +2
- RHSA-2026:54395 Released 2026-08-12 · Red Hat rating ImportantRed Hat Quay 3.17.4
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:51349 Released 2026-08-06 · Red Hat rating ImportantGeneral availability of the satellite/iop-host-inventory-frontend-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
- RHSA-2026:51348 Released 2026-08-06 · Red Hat rating ImportantTechnical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
- RHSA-2026:51342 Released 2026-08-06 · Red Hat rating ImportantGeneral availability of the satellite/iop-advisor-frontend-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
- RHSA-2026:51197 Released 2026-08-06 · Red Hat rating ImportantTechnical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
- RHSA-2026:51196 Released 2026-08-06 · Red Hat rating ImportantGeneral availability of the satellite/iop-host-inventory-frontend-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
- RHSA-2026:47728 Released 2026-08-06 · Red Hat rating CriticalOpenShift Container Platform 4.17.56 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9 +7
- RHSA-2026:50479 Released 2026-08-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
- RHSA-2026:50340 Released 2026-08-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9 +7
- RHSA-2026:49642 Released 2026-08-03 · Red Hat rating ImportantRed Hat Developer Hub 1.10.3 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:48126 Released 2026-07-29 · Red Hat rating ImportantRed Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
- RHSA-2026:48124 Released 2026-07-29 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.1 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +2
- RHSA-2026:44239 Released 2026-07-28 · Red Hat rating ImportantOpenShift Container Platform 4.22.7 security and extras update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ptp-rhel9-operator
- RHSA-2026:44268 Released 2026-07-28 · Red Hat rating ImportantOpenShift Container Platform 4.21.26 security and extras update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9
- RHSA-2026:40765 Released 2026-07-22 · Red Hat rating ImportantOpenShift Container Platform 4.19.39 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:43038 Released 2026-07-21 · Red Hat rating CriticalMigration Toolkit for Applications
- Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9
- RHSA-2026:42815 Released 2026-07-21 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.2 security update
- Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:41929 Released 2026-07-20 · Red Hat rating ImportantRed Hat Developer Hub 1.9.7 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:41928 Released 2026-07-20 · Red Hat rating ImportantRed Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
- RHSA-2026:41066 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.16.5
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:40945 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:40262 Released 2026-07-15 · Red Hat rating ImportantRed Hat Quay 3.9.24
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:40118 Released 2026-07-15 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:37628 Released 2026-07-14 · Red Hat rating ImportantOpenShift Container Platform 4.20.29 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:37585 Released 2026-07-14 · Red Hat rating ImportantOpenShift Container Platform 4.22.5 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9, registry.redhat.io/openshift4/ose-thanos-rhel9
- RHSA-2026:37186 Released 2026-07-14 · Red Hat rating ImportantOpenShift Container Platform 4.21.24 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix planned: Will not fix |
| Network Observability Operator | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:61314 |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat AMQ Broker 7.14.1 | Fixed | RHSA-2026:66488 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 | Fixed | RHSA-2026:57191 |
| Red Hat Advanced Cluster Management for Kubernetes 2.17 | Fixed | RHSA-2026:60386 |
| Red Hat Ansible Automation Platform 2.2 | Fixed | RHSA-2026:42815 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:50479 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:50340 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:48126, RHSA-2026:49642 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:41929 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:54760 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:40118, RHSA-2026:40945 |
| Red Hat Edge Manager 1.2 | Fixed | RHSA-2026:68006, RHSA-2026:68254 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Fixed | RHSA-2026:57590 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:41928 |
| Red Hat Migration Toolkit for Applications 8.2 | Fixed | RHSA-2026:43038 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520, RHSA-2026:84734 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:50758 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:47728 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:40765 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:37628 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:37186, RHSA-2026:44268 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:37585, RHSA-2026:44239 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:48124 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:56431 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:56366 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2026:57013 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:41066 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:54395 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:40262 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:51342, RHSA-2026:51348, RHSA-2026:51349, RHSA-2026:63371 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:51196, RHSA-2026:51197 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:57194 |
| multicluster engine for Kubernetes 2.17 | Fixed | RHSA-2026:59593 |
Not affected: 37 products
- Cluster Observability Operator 1.5
- Cryostat 4
- OpenShift Serverless
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat Developer Hub 1.10
- Red Hat Developer Hub 1.9
- Red Hat Discovery 2
- Red Hat Edge Manager 1.1
- Red Hat Edge Manager 1.2
- Red Hat Migration Toolkit 1.8
- Red Hat Migration Toolkit for Applications 8.2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat OpenShift Virtualization 4
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.19
- Red Hat Openshift Data Foundation 4.20
- Red Hat Quay 3.14
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
- Red Hat Satellite 6
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.17
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13676
- 2026-10-03 Alias added: GHSA-4c8g-83qw-93j6
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-25 EPSS moved to the 50th–90th percentile
- 2026-10-25 Priority changed: LOW → MEDIUM
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
References
Advisory 5
Other 48
- https://github.com/fastify/fast-uri/pull/188
- https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05
- https://github.com/fastify/fast-uri/commit/21ea1f9d70495c931f55dff893a8fa38f4f2e6bd
- https://github.com/fastify/fast-uri/commit/01db48010f594b98f7b323be18b393791c66ed1d
- https://access.redhat.com/errata/RHSA-2026:63371
- https://access.redhat.com/errata/RHSA-2026:61314
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:60386
- https://access.redhat.com/errata/RHSA-2026:59593
- https://access.redhat.com/errata/RHSA-2026:57590
- https://access.redhat.com/errata/RHSA-2026:57194
- https://access.redhat.com/errata/RHSA-2026:57191
- https://access.redhat.com/errata/RHSA-2026:57013
- https://access.redhat.com/errata/RHSA-2026:56431
- https://access.redhat.com/errata/RHSA-2026:56366
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://github.com/fastify/fast-uri
- https://github.com/fastify/fast-uri/releases/tag/v2.4.2
- https://github.com/fastify/fast-uri/releases/tag/v3.1.3
- https://github.com/fastify/fast-uri/releases/tag/v4.0.1
- https://access.redhat.com/errata/RHSA-2026:37186
- https://access.redhat.com/errata/RHSA-2026:37585
- https://access.redhat.com/errata/RHSA-2026:37628
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:40765
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:41929
- https://access.redhat.com/errata/RHSA-2026:42815
- https://access.redhat.com/errata/RHSA-2026:43038
- https://access.redhat.com/errata/RHSA-2026:44239
- https://access.redhat.com/errata/RHSA-2026:44268
- https://access.redhat.com/errata/RHSA-2026:47728
- https://access.redhat.com/errata/RHSA-2026:48124
- https://access.redhat.com/errata/RHSA-2026:48126
- https://access.redhat.com/errata/RHSA-2026:49642
- https://access.redhat.com/errata/RHSA-2026:50340
- https://access.redhat.com/errata/RHSA-2026:50479
- https://access.redhat.com/errata/RHSA-2026:50758
- https://access.redhat.com/errata/RHSA-2026:51196
- https://access.redhat.com/errata/RHSA-2026:51197
- https://access.redhat.com/errata/RHSA-2026:51342
- https://access.redhat.com/errata/RHSA-2026:51348
- https://access.redhat.com/errata/RHSA-2026:51349
- https://access.redhat.com/errata/RHSA-2026:54760
More Fast-uri vulnerabilities
- TI-2026-05545 fast-uri vulnerable to path traversal via percent-encoded dot segments CVSS 3.1HIGH 7.5
- TI-2026-58005 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority CVSS 3.1HIGH 7.5
- TI-2026-53157 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references CVSS 3.1HIGH 7.5
- TI-2026-15158 fast-uri vulnerable to host confusion via backslash authority introducer CVSS 3.1HIGH 7.5
- TI-2026-13562 fast-uri vulnerable to host confusion via literal backslash authority delimiter CVSS 3.1HIGH 7.5
- TI-2026-05546 fast-uri vulnerable to host confusion via percent-encoded authority delimiters CVSS 3.1HIGH 7.5
Sources
- CVE-2026-13676 · CVE Program
- CVE-2026-13676 · NVD
- FIRST EPSS
- GHSA-4c8g-83qw-93j6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-13676 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences