Kaka

The `normalize()` function decoded percent-encoded authority delimiters within the host component and re-emitted them as raw delimiters during serialization. This allows a host combining an allowed domain, an encoded at-sign, and a different domain to be re-emitted with the at-sign as a raw userinfo separator, effectively changing the URI's authority to the second domain. Applications that normalize untrusted URLs before performing host allowlist checks, redirect validation, or outbound request routing can be steered to an authority different from the one specified in the input.

The `normalize()` and `equal()` functions decode percent-encoded path separators and dot segments before performing dot-segment removal. This causes encoded path data to be treated as actual slashes and parent-directory references, allowing distinct URIs to collapse into the same normalized path. Consequently, applications using these functions to enforce path-based policies on attacker-controlled URLs may be bypassed, as a path appearing confined under an allowed prefix can normalize to a different location.

When `trustProxy` is configured with a restrictive trust function, such as a specific IP, a subnet, a hop count, or a custom function, the `request.protocol` and `request.host` getters read `X-Forwarded-Proto` and `X-Forwarded-Host` headers from any connection, including those from untrusted IPs. This allows an attacker connecting directly to Fastify to bypass the proxy and spoof the protocol and host seen by the application. This issue impacts applications that rely on `request.protocol` or `request.host` for security-critical decisions, including HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, and host-based routing.