fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
Priority LOW 22CWE-178Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 1 fixed, 33 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Fix Partial fast-uri (fast-uri): 2.4.7, 3.1.8, 4.1.5fast-uri (npm): 2.4.7, 3.1.8, 4.1.5Red Hat: 3 advisoriesRed Hat: 1 fixed, 33 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fast-uri | fast-uri | before 2.4.7; 3.0.0 to before 3.1.8; 4.0.0 to before 4.1.5 | 2.4.7, 3.1.8, 4.1.5 | Patch available | CNA |
| — | fast-uri (npm) | before 2.4.7 | 2.4.7 | Patch available | GHSA-hrr3-gc8f-f4qj |
| — | fast-uri (npm) | 3.0.0 to before 3.1.8 | 3.1.8 | Patch available | GHSA-hrr3-gc8f-f4qj |
| — | fast-uri (npm) | 4.0.0 to before 4.1.5 | 4.1.5 | Patch available | GHSA-hrr3-gc8f-f4qj |
- fast-uri Vendorfast-uri Affected before 2.4.7; 3.0.0 to before 3.1.8; 4.0.0 to before 4.1.5 Fixed in 2.4.7, 3.1.8, 4.1.5 Patch available CNA
- fast-uri (npm) Vendor— Affected before 2.4.7 Fixed in 2.4.7 Patch available GHSA-hrr3-gc8f-f4qj
- fast-uri (npm) Vendor— Affected 3.0.0 to before 3.1.8 Fixed in 3.1.8 Patch available GHSA-hrr3-gc8f-f4qj
- fast-uri (npm) Vendor— Affected 4.0.0 to before 4.1.5 Fixed in 4.1.5 Patch available GHSA-hrr3-gc8f-f4qj
Remediation
- Fix · CNA fast-uri (fast-uri) Fixed in 2.4.7, 3.1.8, 4.1.5
- Fix · GHSA-hrr3-gc8f-f4qj fast-uri (npm) Fixed in 2.4.7 Advisory →
- Fix · GHSA-hrr3-gc8f-f4qj fast-uri (npm) Fixed in 3.1.8 Advisory →
- Fix · GHSA-hrr3-gc8f-f4qj fast-uri (npm) Fixed in 4.1.5 Advisory →
Red Hat 3 advisories
- RHSA-2026:71906 Released 2026-09-25 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.2-13.2.1-0.7.hum1@aarch64, grafana13.2-13.2.1-0.7.hum1@src, grafana13.2-13.2.1-0.7.hum1@x86_64
- RHSA-2026:71040 Released 2026-09-23 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.6-0.3.hum1@aarch64, grafana13.1-13.1.6-0.3.hum1@src, grafana13.1-13.1.6-0.3.hum1@x86_64
- RHSA-2026:68143 Released 2026-09-16 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana12.4-12.4.10-0.4.hum1@aarch64, grafana12.4-12.4.10-0.4.hum1@src, grafana12.4-12.4.10-0.4.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management On Premise | Affected | No fix yet: Fix deferred |
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 11 | Affected | No fix planned: Out of support scope |
| Red Hat Directory Server 12 | Affected | No fix planned: Out of support scope |
| Red Hat Edge Manager 1 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix planned: Out of support scope |
| Secrets Management Console for Red Hat OpenShift | Affected | No fix planned: Out of support scope |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:68143, RHSA-2026:71040, RHSA-2026:71906 |
Not affected: 4 products
- Red Hat Build of Podman Desktop
- Red Hat Discovery 2
- Red Hat Hardened Images
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-86472
- 2026-10-03 Alias added: GHSA-hrr3-gc8f-f4qj
- 2026-10-12 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
Other 7
- https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1
- https://github.com/fastify/fast-uri
- https://github.com/fastify/fast-uri/releases/tag/v2.4.7
- https://github.com/fastify/fast-uri/releases/tag/v3.1.8
- https://github.com/fastify/fast-uri/releases/tag/v4.1.5
More fast-uri vulnerabilities
- TI-2026-20392 WebdriverIO has Command Injection in the BrowserStack Service CVSS 3.1CRITICAL 9.8
- TI-2022-08786 qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers… CVSS 3.1HIGH 7.5
- TI-2026-09267 nvm executes commands from a malicious Node.js mirror's version strings CVSS 4.0HIGH 7.5
- TI-2026-30143 Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping CVSS 3.1MEDIUM 6.4
- TI-2025-32161 Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with… CVSS 3.1MEDIUM 5.5
- TI-2024-09717 Preload arbitrary resources by injecting additional `Link` headers CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-86472 · CVE Program
- CVE-2026-86472 · NVD
- FIRST EPSS
- GHSA-hrr3-gc8f-f4qj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-86472 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences