Host Confusion Issue in fast-uri URI Parser for Node.js

CVE-2026-75931

What is CVE-2026-75931?

The fast-uri URI parser for Node.js contains a flaw where the canonicalization of a host is conditional based on whether an explicit scheme is provided. This inconsistency allows various methods—such as parse, resolve, normalize, and equal—to offer differing interpretations of the same input. Consequently, an application could extract a host for policy checks only to later resolve a different destination, leading to potential policy bypass. It is crucial for users to upgrade to versions 2.4.5, 3.1.6, or 4.1.3, where the issue has been addressed and consistent canonicalization is ensured.

References