GHSA-qw65-cvwx-89v3

Impact

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose port is @127.0.0.1:8124 produces http://trusted.example:@127.0.0.1:8124/app, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it.

This affects applications that build URIs from parts and assign untrusted data to the port component (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable through serialize(), normalize(), and equal() in their object forms. A port obtained from parse() is always digits and is not affected.

Patches

This vulnerability has been patched in fast-uri 4.1.4, 3.1.7, and 2.4.6. recomposeAuthority now rejects any port that is not *DIGIT per RFC 3986. All users should upgrade.

Workarounds

If upgrading is not immediately possible, validate the port value against the RFC 3986 grammar (digits only) before passing a component to serialize(), normalize(), or equal(), and reject anything else, for example if (!/^\d*$/.test(String(port))) throw new Error('invalid port').