fast-uri versions 2

fast-uri is a high-performance RFC 3986 URI parser used heavily by the Fastify ecosystem and by ajv-formats for JSON Schema uri/uri-reference validation. Versions 2.3.1–3.1.2 and 4.0.0 skip proper Unicode/IDN canonicalization on HTTP-family URLs, so a hostname containing homoglyphs, mixed scripts, or unnormalized Unicode forms can be parsed to a *different* effective authority than what an allowlist check sees. The library returns a host string that passes a string-equality or suffix check against trusted.com but, when later resolved by Node's DNS resolver or fetch(), points somewhere else entirely.

Vendor-rated HIGH (7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) treats this as a network-reachable integrity break. That score is *defensible for the worst-case consumer* (an SSRF allowlist, an OAuth redirect_uri validator, a webhook URL verifier) but overstates the typical case — most fast-uri callers parse URIs for routing or schema validation, not for security decisions. The bug is real and worth fixing, but the blast radius is bounded by what each downstream caller does with the parsed host.

Why this verdict

• Friction — caller-dependent impact: the I:H rating only materializes if parsed.host is the *sole* basis for an allowlist decision. Most Fastify routes use fast-uri for routing/normalization, not authorization.
• Friction — defense-in-depth common: OAuth providers enforce exact-match redirect_uri, egress proxies enforce destination allowlists, and many apps double-parse with WHATWG URL which normalizes IDN correctly.
• Role multiplier: fast-uri is a *parser library*, not a high-value-role component. Even on an IdP or webhook gateway, the chain ends at *one* misrouted request, not domain or fleet compromise — no floor escalation applies.
• Easy fix: patch is a minor-version bump with no breaking API changes; SCA tools will surface it within days.

Why not higher?

Not HIGH because the chain requires a specific downstream pattern (host-string allowlist with no secondary canonicalization) that is not the dominant usage of the library. There is no KEV listing, no active exploitation, and no role-multiplier (parser libs don't carry the blast radius of an IdP or hypervisor).

Why not lower?

Not LOW because the bug *does* enable SSRF / open-redirect / OAuth-code theft in real applications that exist today, the affected library is deployed at enormous scale through Fastify, and weaponization for a targeted application is straightforward once a researcher identifies a vulnerable validator.

1. Inventory transitive fast-uri usage — Run npm ls fast-uri (or pnpm why fast-uri / yarn why fast-uri) across every Node service. Within the 365-day MEDIUM remediation window, prioritize services that accept user-supplied URLs (webhooks, OAuth, SSRF-guarded fetchers).
2. Add a second-pass WHATWG URL canonicalization — Wherever you validate a URL for trust purposes, re-parse with Node's built-in new URL(input) and compare .hostname (which applies correct IDN/Punycode normalization) against the allowlist *in addition to* any fast-uri-based check. Deploy in your normal change window — there is no mitigation SLA for MEDIUM.
3. Enforce egress allowlists from app tiers — App servers handling user-supplied URLs should egress through an HTTP proxy with an explicit destination allowlist. This neutralizes IDN-confusion SSRF independent of the parser fix.
4. Upgrade Fastify to a version that pins the patched fast-uri — Once Fastify ships a release pinning fast-uri ≥ 3.1.3 / ≥ 4.0.1, bump Fastify as part of normal dependency hygiene rather than per-service overrides.

Run on any Node project's repo root (developer workstation or CI runner) where a package-lock.json / pnpm-lock.yaml / yarn.lock is present. No special privileges required. Example: ./check-fast-uri.sh /path/to/repo.

#!/usr/bin/env bash
# noisgate: detect vulnerable fast-uri (CVE-2026-13676)
# Vulnerable: 2.3.1 <= v <= 3.1.2, or v == 4.0.0
# Fixed: 3.1.3+, 4.0.1+
set -u
REPO="${1:-.}"
cd "$REPO" || { echo "UNKNOWN: cannot cd $REPO"; exit 2; }

if ! command -v node >/dev/null 2>&1; then
  echo "UNKNOWN: node not installed"; exit 2
fi

if ! command -v npm >/dev/null 2>&1; then
  echo "UNKNOWN: npm not installed"; exit 2
fi

# Collect every installed fast-uri version (handles transitive)
VERSIONS=$(npm ls fast-uri --all --json 2>/dev/null \
  | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{const j=JSON.parse(d);const out=new Set();(function walk(n){if(!n||typeof n!=='object')return;if(n.dependencies){for(const [k,v] of Object.entries(n.dependencies)){if(k==='fast-uri'&&v.version)out.add(v.version);walk(v);}}})(j);process.stdout.write([...out].join('\\n'));}catch(e){}}")

if [ -z "$VERSIONS" ]; then
  echo "PATCHED: fast-uri not present in dependency tree"
  exit 0
fi

vuln=0
while IFS= read -r v; do
  [ -z "$v" ] && continue
  echo "found fast-uri $v"
  node -e "const semver=(a,b)=>a.split('.').map(Number).reduce((r,n,i)=>r||(n-(b.split('.').map(Number)[i]||0)),0);const v='$v';if((semver(v,'2.3.1')>=0 && semver(v,'3.1.2')<=0) || v==='4.0.0'){process.exit(1);}else{process.exit(0);}"
  if [ $? -eq 1 ]; then
    echo "  -> VULNERABLE"
    vuln=1
  else
    echo "  -> patched"
  fi
done <<< "$VERSIONS"

if [ $vuln -eq 1 ]; then
  echo "VULNERABLE"
  exit 1
fi
echo "PATCHED"
exit 0

Sources

1. fast-uri GitHub repository
2. fast-uri GitHub Security Advisories
3. BlackHat USA 2019 — HostSplit: Exploitable Antipatterns in Unicode Normalization
4. OWASP — Unicode Encoding attacks
5. CWE-436: Interpretation Conflict
6. RFC 3986 — URI Generic Syntax
7. RFC 5890 — IDNA Definitions
8. Node.js WHATWG URL API