CVE-2026-86472

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.7 fast-uri versions 3.0.0 through 3.1.7 fast-uri versions 4.0.0 through 4.1.4

Description The software folds the host to lowercase before percent-decoding it. Consequently, a percent-encoded uppercase octet, such as %41, decodes to a literal uppercase character that is not folded. In scheme-relative references (e.g., //host), the absence of a scheme prevents the host canonicalization that would typically correct this, causing the parse, normalize, and equal functions to disagree on the same host. Applications performing case-sensitive host decisions, such as those using an allowlist or denylist, can be bypassed using percent-encoded uppercase octets. Since DNS and HTTP hostnames are case-insensitive, the bypassed input still reaches the intended destination.

Recommendations Update to version 2.4.7 or later. Update to version 3.1.8 or later. Update to version 4.1.5 or later. As a temporary workaround, compare hosts case-insensitively by lowercasing the parsed host before making any allowlist or denylist decisions.