🛡️ CVE-2026-13676 — fast-uri

🟠 CVSS 8.0 — High ✅ No Known Exploit CWE-436 OSV

8.0

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

fast-uri vulnerable to host confusion via failed IDN canonicalization

Impact

fast-uri versions >= 2.3.1, <= 4.0.0 fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls URL.domainToASCII(...) on the global WHATWG URL constructor, where that helper does not exist. The resulting TypeError is silently routed into parsed.error, but parse(), normalize(), and equal() all return with the host left in its original Unicode form.

For example, http://127。0。0。1/ is treated by fast-uri as host 127。0。0。1, while Node's WHATWG URL parser and fetch() canonicalize the same input to 127.0.0.1.

Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination.

Patches

Upgrade to fast-uri v4.0.1, v3.1.3, or v2.4.2

Workarounds

None. Upgrade to the patched version.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity high, availability none.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network — reachable from anywhere that can route to the service.
Attack complexity: Low — the attack works reliably, with no preparation.
Privileges required: None — an unauthenticated stranger can try it.
User interaction: None — nobody has to be tricked into anything.
Scope: Unchanged — the damage stays inside the vulnerable component.
Confidentiality impact: None.
Integrity impact: High — total loss, or loss the attacker controls.
Availability impact: None.

Weakness class

CVE-2026-13676 is classified as CWE-436: Interpretation Conflict. Two components parse the same data differently, so a check in one is bypassed in the other.

Affected software

CVE-2026-13676 is recorded against 1 package.

fast-uri

Timeline and source

Published on 21 July 2026 and last revised on 20 August 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from OSV.

References

Other advisories for this package

fast-uri has other advisories on record. If you are patching this one, these are worth checking on the same host:

ROOT-APP-NPM-CVE-2026-16221 (8.0 High, published 17 Aug 2026)
ROOT-APP-NPM-CVE-2026-13676 (8.0 High, published 17 Aug 2026)
ROOT-APP-NPM-CVE-2026-6322 (8.0 High, published 13 Aug 2026)
ROOT-APP-NPM-CVE-2026-6321 (8.0 High, published 13 Aug 2026)
CLSA-2026-1784769612 (published 4 Aug 2026)
CLSA-2026-1784769538 (published 4 Aug 2026)
CLSA-2026-1784682957 (published 4 Aug 2026)
CLSA-2026-1784596352 (published 4 Aug 2026)

Same weakness in other software

These advisories are the same class of weakness (CWE-436: Interpretation Conflict) in other software:

CVE-2026-49473 (8.8 High, published 13 Aug 2026)
CVE-2026-14643 (5.9 Medium, published 3 Aug 2026)
CVE-2026-18446 (8.0 High, published 3 Aug 2026)
CVE-2026-67201 (8.6 High, published 29 Jul 2026)
CVE-2026-49332 (8.5 High, published 28 Jul 2026)
CVE-2026-63030 (9.5 Critical, published 27 Jul 2026)
CVE-2026-16221 (8.0 High, published 21 Jul 2026)
CVE-2026-44974 (8.0 High, published 17 Jul 2026)

Details

Severity HIGH

CVSS Score 8.0

CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE CWE-436

Public Exploit ✅ No

Source OSV

Published 2026-07-21

Updated 2026-08-20

Modified 2026-08-20

Fix URL https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6

Affected Packages

Software	From version	Fixed in
fast-uri	—	—

References

WEB https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-13676

WEB https://github.com/fastify/fast-uri/pull/188

WEB https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05

WEB https://github.com/fastify/fast-uri/commit/21ea1f9d70495c931f55dff893a8fa38f4f2e6bd

WEB https://github.com/fastify/fast-uri/commit/01db48010f594b98f7b323be18b393791c66ed1d

WEB https://access.redhat.com/errata/RHSA-2026:51342

WEB https://access.redhat.com/errata/RHSA-2026:51348

WEB https://access.redhat.com/errata/RHSA-2026:51349

WEB https://access.redhat.com/errata/RHSA-2026:54760

WEB https://access.redhat.com/errata/RHSA-2026:56366

WEB https://access.redhat.com/errata/RHSA-2026:56431

WEB https://access.redhat.com/errata/RHSA-2026:57013

WEB https://access.redhat.com/errata/RHSA-2026:57191

WEB https://access.redhat.com/errata/RHSA-2026:57194

WEB https://access.redhat.com/security/cve/CVE-2026-13676

WEB https://bugzilla.redhat.com/show_bug.cgi?id=2494197

WEB https://cna.openjsf.org/security-advisories.html

PACKAGE https://github.com/fastify/fast-uri

WEB https://github.com/fastify/fast-uri/releases/tag/v2.4.2

WEB https://github.com/fastify/fast-uri/releases/tag/v3.1.3

WEB https://github.com/fastify/fast-uri/releases/tag/v4.0.1

WEB https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json

WEB https://access.redhat.com/errata/RHSA-2026:37186

WEB https://access.redhat.com/errata/RHSA-2026:37585

WEB https://access.redhat.com/errata/RHSA-2026:37628

WEB https://access.redhat.com/errata/RHSA-2026:40118

WEB https://access.redhat.com/errata/RHSA-2026:40262

WEB https://access.redhat.com/errata/RHSA-2026:40765

WEB https://access.redhat.com/errata/RHSA-2026:40945

WEB https://access.redhat.com/errata/RHSA-2026:41066

WEB https://access.redhat.com/errata/RHSA-2026:41928

WEB https://access.redhat.com/errata/RHSA-2026:41929

WEB https://access.redhat.com/errata/RHSA-2026:42815

WEB https://access.redhat.com/errata/RHSA-2026:43038

WEB https://access.redhat.com/errata/RHSA-2026:44239

WEB https://access.redhat.com/errata/RHSA-2026:44268

WEB https://access.redhat.com/errata/RHSA-2026:47728

WEB https://access.redhat.com/errata/RHSA-2026:48124

WEB https://access.redhat.com/errata/RHSA-2026:48126

WEB https://access.redhat.com/errata/RHSA-2026:49642

WEB https://access.redhat.com/errata/RHSA-2026:50340

WEB https://access.redhat.com/errata/RHSA-2026:50479

WEB https://access.redhat.com/errata/RHSA-2026:50758

WEB https://access.redhat.com/errata/RHSA-2026:51196

WEB https://access.redhat.com/errata/RHSA-2026:51197

🔗 NVD 🔗 Mitre ✅ Fix / Advisory

Similar Threats

Site Security Check

Is fast-uri part of your stack?

CVE-2026-13676 is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

🛡️ CVE-2026-13676 — fast-uri

Description

Impact

Patches

Workarounds

How this vulnerability can be exploited

CVSS metrics in full

Weakness class

Affected software

Timeline and source

References

Other advisories for this package

Same weakness in other software

Is fast-uri part of your stack?

Browse related advisories

Company

Resources

Services

Trusted

Subscribe