Homepage

fast-uri@2.4.2

Dependency-free RFC 3986 URI toolbox

  • latest version

    4.1.2

  • latest non vulnerable version

    4.1.2

  • first published

    4 years ago

  • latest version published

    9 days ago

  • licenses detected

    • MIT
      >=0.0.1 <3.0.3
  • View fast-uri package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the fast-uri package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Interpretation Conflict

    fast-uri is a Dependency-free RFC 3986 URI toolbox

    Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus() and resolve() in index.js. An attacker can bypass host-based URL checks and steer requests to an unintended host by supplying a URI that uses \\, /\\, or \\/ in place of // after the scheme. The parser folds those sequences into the path instead of recognizing an authority, while Node’s WHATWG URL treats them as a real authority on special schemes such as http, https, ws, wss, ftp, and file. Applications that validate a URL with fast-uri and then pass the same input to fetch(), undici, or Node’s HTTP clients can be sent to an attacker-controlled destination, enabling SSRF, redirect bypass, or outbound routing abuse.

    How to fix Interpretation Conflict?

    Upgrade fast-uri to version 2.4.4, 3.1.5, 4.1.2 or higher.

    <2.4.4>=3.0.0 <3.1.5>=4.0.0 <4.1.2
    • H
    Interpretation Conflict

    fast-uri is a Dependency-free RFC 3986 URI toolbox

    Affected versions of this package are vulnerable to Interpretation Conflict via literal backslash handling in parseWithStatus in index.js. An attacker can bypass host-based validation by supplying a URI such as http://evil.com\@allowed.com, causing fast-uri to treat the input as an allowed host while Node’s WHATWG URL parser resolves it to a different destination. This breaks SSRF, redirect, and origin allowlist checks, letting requests be steered to unintended internal, loopback, or metadata endpoints.

    Notes

    • The mismatch matters anywhere the same URI string is parsed by fast-uri for policy and then handed to Node consumers that use WHATWG parsing, including fetch(), undici, and Node http/https clients.

    How to fix Interpretation Conflict?

    Upgrade fast-uri to version 2.4.3, 3.1.4, 4.1.1 or higher.

    >=2.3.1 <2.4.3>=3.0.0 <3.1.4>=4.0.0 <4.1.1
    Go back to all versions of this package