Interpretation Conflictfast-uri is a Dependency-free RFC 3986 URI toolbox
Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus() and resolve() in index.js. An attacker can bypass host-based URL checks and steer requests to an unintended host by supplying a URI that uses \\, /\\, or \\/ in place of // after the scheme. The parser folds those sequences into the path instead of recognizing an authority, while Node’s WHATWG URL treats them as a real authority on special schemes such as http, https, ws, wss, ftp, and file. Applications that validate a URL with fast-uri and then pass the same input to fetch(), undici, or Node’s HTTP clients can be sent to an attacker-controlled destination, enabling SSRF, redirect bypass, or outbound routing abuse.
How to fix Interpretation Conflict? Upgrade fast-uri to version 2.4.4, 3.1.5, 4.1.2 or higher.
| <2.4.4>=3.0.0 <3.1.5>=4.0.0 <4.1.2 |
Interpretation Conflictfast-uri is a Dependency-free RFC 3986 URI toolbox
Affected versions of this package are vulnerable to Interpretation Conflict via literal backslash handling in parseWithStatus in index.js. An attacker can bypass host-based validation by supplying a URI such as http://evil.com\@allowed.com, causing fast-uri to treat the input as an allowed host while Node’s WHATWG URL parser resolves it to a different destination. This breaks SSRF, redirect, and origin allowlist checks, letting requests be steered to unintended internal, loopback, or metadata endpoints.
Notes
- The mismatch matters anywhere the same URI string is parsed by
fast-uri for policy and then handed to Node consumers that use WHATWG parsing, including fetch(), undici, and Node http/https clients.
How to fix Interpretation Conflict? Upgrade fast-uri to version 2.4.3, 3.1.4, 4.1.1 or higher.
| >=2.3.1 <2.4.3>=3.0.0 <3.1.4>=4.0.0 <4.1.1 |
Interpretation Conflictfast-uri is a Dependency-free RFC 3986 URI toolbox
Affected versions of this package are vulnerable to Interpretation Conflict in its parse(), normalize(), and equal() functions, which call the nonexistent URL.domainToASCII() static method and silently swallow the resulting TypeError into parsed.error, leaving an internationalized hostname in its unconverted Unicode form. An attacker can steer host-based security policies to an unintended destination by supplying a URL with a Unicode or fullwidth hostname such as http://127。0。0。1/, which is parsed with the host left as 127。0。0。1 while Node's WHATWG URL parser and fetch() canonicalize it to 127.0.0.1. Exploitation requires the application to use this library for host-based decisions such as denylists, loopback filtering, or redirect and proxy validation before passing the URL to a downstream consumer that canonicalizes the host differently.
How to fix Interpretation Conflict? Upgrade fast-uri to version 2.4.2, 3.1.3, 4.0.1 or higher.
| >=2.3.1 <2.4.2>=3.0.0 <3.1.3>=4.0.0 <4.0.1 |
