GHSA-f65p-4m7j-42xc

Suggest an improvement
Source
https://github.com/advisories/GHSA-f65p-4m7j-42xc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f65p-4m7j-42xc/GHSA-f65p-4m7j-42xc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f65p-4m7j-42xc
Aliases
Downstream
Published
2026-09-02T15:43:30Z
Modified
2026-09-10T03:51:15Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Details

Impact

fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize('http://[::not-valid]/private') returns http://[::]/private, and [fc00::not-hex] and [fe80::not-hex] collapse to [fc00::] and [fe80::]. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (::1), unique-local, or link-local. Because parse().error is unset for these inputs, checking it does not protect the consumer.

Patches

Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. Malformed IPv6 literals are now rejected with a host error instead of being normalized to a valid address.

Workarounds

Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri, or route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.

Database specific 
{
    "cwe_ids": [
        "CWE-20",
        "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T15:43:30Z",
    "nvd_published_at": "2026-08-24T10:16:40Z",
    "severity": "HIGH"
}
References

Affected packages

npm / fast-uri

Package

Name
fast-uri
View open source insights on deps.dev
Purl
pkg:npm/fast-uri

Affected ranges

Type
SEMVER
Events
Introduced
2.3.1
Fixed
2.4.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f65p-4m7j-42xc/GHSA-f65p-4m7j-42xc.json"

npm / fast-uri

Package

Name
fast-uri
View open source insights on deps.dev
Purl
pkg:npm/fast-uri

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.1.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f65p-4m7j-42xc/GHSA-f65p-4m7j-42xc.json"

npm / fast-uri

Package

Name
fast-uri
View open source insights on deps.dev
Purl
pkg:npm/fast-uri

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.1.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f65p-4m7j-42xc/GHSA-f65p-4m7j-42xc.json"