Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75931— fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

Quick assessment

Affected
fast-uri fast-uri
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fast-uri 是 Node.js 的一个 URI 解析器。仅当输入中包含显式协议（scheme）时，它才会将主机名规范化为 ASCII 形式；而对于类似双斜杠开头的协议相对引用（scheme-relative reference），它会按原样返回主机名，且不设置任何错误。因此，fast-uri 的各个入口函数行为不一致：parse、resolve、normalize 和 equal 函数对于相同的输入，可能仅因是否显式写出协议而产生不同的主机名结果；even equal 函数对相同的主机名对可能返回相反的判定结

CVSS 7.5 · High EPSS 0.25% · P16

Possible ATT&CK Techniques 1 AI

T1518.001 · Security Software Discovery

Affected Version Matrix 6

VendorProduct Version RangeStatus
fast-uri fast-uri 2.4.2< 2.4.5 affected
2.4.5 unaffected
3.1.3< 3.1.6 affected
3.1.6 unaffected
4.0.1< 4.1.3 affected
4.1.3 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75931

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Source: CVE Program / CVE List V5
Vulnerability Description
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a patched version.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
解释冲突
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fast-uri fast-uri 2.4.2 ~ 2.4.5 -

II. Public POCs for CVE-2026-75931

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9807 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-75931

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75931 (1)

Same Patch Batch · fast-uri · 2026-08-24 · 4 CVEs total

CVE-2026-75899 7.5 HIGH fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
CVE-2026-75975 7.5 HIGH fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
CVE-2026-76172 7.5 HIGH fast-uri vulnerable to host confusion via percent-encoded scheme normalization

IV. Related Vulnerabilities

Same product: fast-uri
Same vendor: fast-uri
Same weakness: CWE-436

V. Comments for CVE-2026-75931

No comments yet

Leave a comment