fast-uri 3.1.6

Direct Vulnerabilities

Known vulnerabilities in the fast-uri package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Host Confusion fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Host Confusion in the `parse()` function, which returns a host that begins with `[` but has no closing `]`, such as `[@127.0.0.1`, without validating it as an IPv6 literal or canonicalizing it as a domain name, leaving `error` undefined. An attacker can cause an application to make security decisions on a different host than HTTP clients resolve, defeating SSRF denylists, redirect allowlists, or proxy routing, by supplying a URL whose authority contains an unbalanced bracket. This affects applications that use the host from `parse()`, `normalize()`, `equal()`, or `resolve()` for access decisions while forwarding the original URL to an HTTP client. How to fix Host Confusion? Upgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.	>=2.4.5 <2.4.6>=3.1.6 <3.1.7>=4.1.3 <4.1.4
H Improper Encoding or Escaping of Output fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values. How to fix Improper Encoding or Escaping of Output? Upgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.	<2.4.6>=3.0.0 <3.1.7>=4.0.0 <4.1.4

Vulnerability

Vulnerable Version

Host Confusion

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Host Confusion in the parse() function, which returns a host that begins with [ but has no closing ], such as [@127.0.0.1, without validating it as an IPv6 literal or canonicalizing it as a domain name, leaving error undefined. An attacker can cause an application to make security decisions on a different host than HTTP clients resolve, defeating SSRF denylists, redirect allowlists, or proxy routing, by supplying a URL whose authority contains an unbalanced bracket. This affects applications that use the host from parse(), normalize(), equal(), or resolve() for access decisions while forwarding the original URL to an HTTP client.

How to fix Host Confusion?

Upgrade fast-uri to version 2.4.6, 3.1.7, 4.1.4 or higher.

>=2.4.5 <2.4.6>=3.1.6 <3.1.7>=4.1.3 <4.1.4

Improper Encoding or Escaping of Output

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the recomposeAuthority function, which escapes the userinfo and host components but concatenates the port field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as @127.0.0.1:8124, which demotes the legitimate host to userinfo and yields http://trusted.example:@127.0.0.1:8124/app. This requires the application to build URIs from separate components and assign untrusted data directly to the port field of an object passed to serialize(), normalize(), or equal(), and ports obtained via parse() are unaffected because parsing validates digit-only values.

How to fix Improper Encoding or Escaping of Output?

Upgrade fast-uri to version 2.4.6, 3.1.7, 4.1.4 or higher.

<2.4.6>=3.0.0 <3.1.7>=4.0.0 <4.1.4

fast-uri@3.1.6

Dependency-free RFC 3986 URI toolbox

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically