org.webjars.npm:fast-uri@3.1.4

latest version

3.1.4

first published

7 months ago

latest version published

13 days ago

licenses detected

BSD-3-Clause
[3.0.6,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:fast-uri package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Interpretation Conflict org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict in its `parse()`, `normalize()`, and `equal()` functions, which call the nonexistent `URL.domainToASCII()` static method and silently swallow the resulting `TypeError` into `parsed.error`, leaving an internationalized hostname in its unconverted Unicode form. An attacker can steer host-based security policies to an unintended destination by supplying a URL with a Unicode or fullwidth hostname such as `http://127。0。0。1/`, which is parsed with the host left as `127。0。0。1` while Node's WHATWG URL parser and `fetch()` canonicalize it to `127.0.0.1`. Exploitation requires the application to use this library for host-based decisions such as denylists, loopback filtering, or redirect and proxy validation before passing the URL to a downstream consumer that canonicalizes the host differently. How to fix Interpretation Conflict? A fix was pushed into the `master` branch but not yet published.	[3.0.6,)

Interpretation Conflict

org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Interpretation Conflict in its parse(), normalize(), and equal() functions, which call the nonexistent URL.domainToASCII() static method and silently swallow the resulting TypeError into parsed.error, leaving an internationalized hostname in its unconverted Unicode form. An attacker can steer host-based security policies to an unintended destination by supplying a URL with a Unicode or fullwidth hostname such as http://127。0。0。1/, which is parsed with the host left as 127。0。0。1 while Node's WHATWG URL parser and fetch() canonicalize it to 127.0.0.1. Exploitation requires the application to use this library for host-based decisions such as denylists, loopback filtering, or redirect and proxy validation before passing the URL to a downstream consumer that canonicalizes the host differently.

How to fix Interpretation Conflict?

A fix was pushed into the master branch but not yet published.

[3.0.6,)

Go back to all versions of this package