Double Decoding of the Same Data Affecting fast-uri package, versions >=2.4.1 <2.4.5>=3.1.2 <3.1.6>=4.0.0 <4.1.3

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in normalize() and resolve() and the authority recomposition logic in index.js and lib/utils.js. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so %25 sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like localhost or a cloud metadata endpoint.

Workarounds

• Reject untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to normalize() or resolve(). This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.

• GitHub Commit
• GitHub Commit
• GitHub Commit v3.1.6
• Maintainer's Advisory