Homepage

fast-uri@2.4.3

Dependency-free RFC 3986 URI toolbox

  • latest version

    4.1.2

  • latest non vulnerable version

    4.1.2

  • first published

    4 years ago

  • latest version published

    9 days ago

  • licenses detected

    • MIT
      >=0.0.1 <3.0.3
  • View fast-uri package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the fast-uri package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Interpretation Conflict

    fast-uri is a Dependency-free RFC 3986 URI toolbox

    Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus() and resolve() in index.js. An attacker can bypass host-based URL checks and steer requests to an unintended host by supplying a URI that uses \\, /\\, or \\/ in place of // after the scheme. The parser folds those sequences into the path instead of recognizing an authority, while Node’s WHATWG URL treats them as a real authority on special schemes such as http, https, ws, wss, ftp, and file. Applications that validate a URL with fast-uri and then pass the same input to fetch(), undici, or Node’s HTTP clients can be sent to an attacker-controlled destination, enabling SSRF, redirect bypass, or outbound routing abuse.

    How to fix Interpretation Conflict?

    Upgrade fast-uri to version 2.4.4, 3.1.5, 4.1.2 or higher.

    <2.4.4>=3.0.0 <3.1.5>=4.0.0 <4.1.2
    Go back to all versions of this package