CVE-2026-75931

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.2 through 2.4.4 fast-uri versions 3.1.3 through 3.1.5 fast-uri versions 4.0.1 through 4.1.2

Description fast-uri, a URI parser for Node.js, fails to consistently canonicalize hosts to ASCII form when processing scheme-relative references (references where the host is preceded by two slashes without an explicit scheme). This inconsistency causes the parse(), resolve(), normalize(), and equal() functions to yield different results for the same input. An application using these functions to validate a host against a policy list before resolving the reference may make a decision based on one host while the actual destination is another, leading to host confusion and policy bypass. IDN canonicalization refers to the process of converting Internationalized Domain Names into a standardized ASCII format known as Punycode.

Recommendations Update versions 2.4.2 through 2.4.4 to 2.4.5. Update versions 3.1.3 through 3.1.5 to 3.1.6. Update versions 4.0.1 through 4.1.2 to 4.1.3.