URL Normalization Flaw in Fast-uri Affects Applications

CVE-2026-6322

What is CVE-2026-6322?

The fast-uri library has a vulnerability that exploits a weakness in its normalize() function. It improperly decodes percent-encoded authority delimiters within the host component and then serializes them incorrectly as raw delimiters. This can allow a host to combine an approved domain with an encoded at-sign and a different domain, causing the URI's authority to be altered to an unintended target. Applications that rely on this library for normalizing untrusted URLs for host allowlist checks or redirect validation can be redirected to a different authority than intended. Users are advised to update to versions 3.1.2 or later to mitigate this issue.

References