Path Equivalencefast-uri is a Dependency-free RFC 3986 URI toolbox
Affected versions of this package are vulnerable to Path Equivalence via the serialize() / normalize() functions, which incorrectly applied RFC 3986 remove_dot_segments to relative-path references. That algorithm is defined only for merged target paths, not for relative references themselves, so normalizing a relative path such as a/../b produced /b (root-relative), x/.. produced /, and ../x produced x. An attacker who can supply a relative URI reference can cause it to resolve to a different resource than intended after normalization, enabling path-traversal-style target substitution.
How to fix Path Equivalence? Upgrade fast-uri to version 2.4.8, 3.1.9, 4.2.3 or higher.
| <2.4.8>=3.0.0 <3.1.9>=4.0.0 <4.2.3 |
Improper Validation of Specified Quantity in Inputfast-uri is a Dependency-free RFC 3986 URI toolbox
Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via canonicalizeHost(), which passes the host directly to new URL('http://' + host) without verifying that the WHATWG parser consumed the entire input as a host. Because the RFC 3986 parser permits @ in the host component, and the WHATWG parser silently strips TAB, LF, and CR, an attacker can supply a URI whose authority is rewritten by the second parser with no error. This allows host spoofing across parse(), normalize(), equal(), and resolve() - for example, parse('http://a@b@evil.com/').host returns 'evil.com' and normalize('http://ev\til.com/p') returns 'http://evil.com/p'.
How to fix Improper Validation of Specified Quantity in Input? Upgrade fast-uri to version 2.4.8, 3.1.9, 4.2.3 or higher.
| >=2.4.2 <2.4.8>=3.1.3 <3.1.9>=4.0.1 <4.2.3 |
Encoding Errorfast-uri is a Dependency-free RFC 3986 URI toolbox
Affected versions of this package are vulnerable to Encoding Error via the decodeValidScheme function, which decoded percent-encoded URI schemes using the deprecated unescape() global (including the JavaScript-only %uXXXX form) before validating them. An attacker can supply a percent-encoded scheme such as %6Aavascript:alert(1) or %u006Aavascript:alert(1), causing normalize() to return a live javascript: URI, resolve() to produce a javascript: URL, and equal() to treat the encoded form as equivalent to the decoded scheme. This enables scheme-confusion attacks, most notably cross-site scripting when the resulting URI is used in a browser navigation or href context.
How to fix Encoding Error? Upgrade fast-uri to version 2.4.8, 3.1.9, 4.2.3 or higher.
| <2.4.8>=3.0.0 <3.1.9>=4.0.0 <4.2.3 |
Path Equivalencefast-uri is a Dependency-free RFC 3986 URI toolbox
Affected versions of this package are vulnerable to Path Equivalence via the serialize(), normalize(), and resolve() functions when called with the non-default option reference: 'suffix' on a reference that has no authority. A bare colon in the first path segment of the emitted relative reference is not escaped, violating RFC 3986 section 3.3/4.2, which causes the output to reparse as an absolute URI with a scheme rather than a relative reference. An attacker who can influence the URI being serialized can exploit this to inject an unintended scheme into the output.
Note: This is only exploitable when the non-default reference: 'suffix' option is explicitly passed to serialize(), normalize(), or resolve().
How to fix Path Equivalence? Upgrade fast-uri to version 2.4.8, 3.1.9, 4.2.3 or higher.
| <2.4.8>=3.0.0 <3.1.9>=4.0.0 <4.2.3 |
