ECHO-64a6-5618-33e8
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-64a6-5618-33e8.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-64a6-5618-33e8
- Upstream
- Withdrawn
- 2026-10-13T09:45:05Z
- Published
- 2026-09-30T00:01:09Z
- Modified
- 2026-10-13T10:15:04Z
- Summary
- Upstream advisory GHSA-58mr-gqgx-xq4g affects only fast-uri 3.1.6 (also 2.4.5 and 4.1.3). It is a regression from the 3.1.6 IPv6 parsing rewrite, which treated a host starting with "[" and not ending in "]" as an IP literal. This package ships 3.1.2 and keeps the original parser: "http://[@127.0.0.1/" parses with userinfo "[" and host 127.0.0.1, the same host Node's URL reaches, and "http://[::1/x" is rejected with an error. The rewrite is not part of this build.
- Details
- References