URI Parsing Vulnerability in Fastify Dependency

CVE-2026-86472

What is CVE-2026-86472?

The fast-uri library, utilized by Fastify and ajv, contains a URI parsing vulnerability that allows attackers to exploit case sensitivity issues. Specifically, before version 2.4.7 and versions 3.0.0 to 3.1.7, and 4.0.0 to 4.1.4, fast-uri does not properly handle percent-encoded uppercase octets. This enables a bypass of security measures that rely on case-sensitive host evaluations, as characters like %41 (representing 'A') are not folded to lowercase during processing. Applications using this library for host allowlisting or denylisting can thus be manipulated to reach unintended destinations. It's crucial to upgrade to fast-uri version 2.4.7, 3.1.8, or 4.1.5 or later to mitigate this vulnerability. As a temporary measure, ensure hosts are compared in a case-insensitive manner.

References