Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86472— fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

Quick assessment

Affected
fast-uri fast-uri
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fast-uri 是一个无依赖的、符合 RFC 3986 规范的 URI 解析器，专为 Node.js 设计，被 Fastify 和 ajv 所使用。在 2.4.7 之前（即 2.x 系列）、从 3.0.0 到 3.1.7、以及从 4.0.0 到 4.1.4 的版本中，fast-uri 在对主机名进行百分号解码（percent-decode）之前，会先将主机名强制转换为小写。这导致像 %41 这样编码的“大写八位组”在解码后变成字母 A，而该字母由于在解码前已被错误地小写化逻辑影响，未能被正确规范化。对于形如 //

CVSS 4.8 · Medium EPSS 0.16% · P6

Affected Version Matrix 6

VendorProduct Version RangeStatus
fast-uri fast-uri < 2.4.7 affected
2.4.7 unaffected
3.0.0< 3.1.8 affected
3.1.8 unaffected
4.0.0< 4.1.5 affected
4.1.5 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86472

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
Source: CVE Program / CVE List V5
Vulnerability Description
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fast-uri fast-uri 0 ~ 2.4.7 -

II. Public POCs for CVE-2026-86472

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86472

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-86472 (1)

IV. Related Vulnerabilities

Same product: fast-uri
Same vendor: fast-uri
Same weakness: CWE-178

V. Comments for CVE-2026-86472

No comments yet

Leave a comment