7.5
High
CVE-2026-13676 fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
Description
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| fast-uri 4.0 | 4.0.0 → < 4.0.1 | 4.0.1 |
| fast-uri 3.1 | earliest → < 3.1.3 | 3.1.3 |
| fast-uri 2.3 | 2.3.1 → < 3.1.3 | 3.1.3 |
| Confidential Compute Attestation | Versions not published | |
| Cryostat 4 | Versions not published | |
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| Multicluster Engine for Kubernetes | Versions not published | |
| Network Observability Operator | Versions not published |
Show the 59 other branches Hide the 59 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenShift Lightspeed | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat AMQ Broker 7 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published | |
| Red Hat Connectivity Link 1 | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Discovery 2 1786634825 | earliest → < 1786634825 | 1786634825 |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| Red Hat OpenShift Container Platform 4.21 1784728481 | earliest → < 1784728481 | 1784728481 |
| Red Hat OpenShift Container Platform 4.22 1784729919 | earliest → < 1784729919 | 1784729919 |
| Red Hat OpenShift Container Platform 4.20 1783596795 | earliest → < 1783596795 | 1783596795 |
| Red Hat Edge Manager 1.1 1784127736 | earliest → < 1784127736 | 1784127736 |
| Red Hat Quay 3.9 1784125838 | earliest → < 1784125838 | 1784125838 |
| Red Hat Quay 3.16 1783955846 | earliest → < 1783955846 | 1783955846 |
| Red Hat OpenShift Container Platform 4.2 1783596795 | earliest → < 1783596795 | 1783596795 |
| Red Hat Developer Hub 1.9 1784210921 | earliest → < 1784210921 | 1784210921 |
| Red Hat Migration Toolkit 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Red Hat Ansible Automation Platform 2.2 1784622951 | earliest → < 1784622951 | 1784622951 |
| Red Hat Migration Toolkit for Applications 8.2 1784109883 | earliest → < 1784109883 | 1784109883 |
| Red Hat OpenShift Container Platform 4.19 1784144829 | earliest → < 1784144829 | 1784144829 |
| Red Hat Developer Hub 1.10 1785411652 | earliest → < 1785411652 | 1785411652 |
| Red Hat OpenShift Dev Spaces 3.29 1784737150 | earliest → < 1784737150 | 1784737150 |
| Red Hat Ansible Automation Platform 2.6 1785773509 | earliest → < 1785773509 | 1785773509 |
| Red Hat Ansible Automation Platform 2.7 1785413994 | earliest → < 1785413994 | 1785413994 |
| Red Hat OpenShift Container Platform 4.17 1784744859 | earliest → < 1784744859 | 1784744859 |
| Red Hat Satellite 6.18 1788230538 | earliest → < 1788230538 | 1788230538 |
| Red Hat Satellite 6.19 1785937325 | earliest → < 1785937325 | 1785937325 |
| Red Hat OpenShift Container Platform 4.16 1785530656 | earliest → < 1785530656 | 1785530656 |
| Red Hat Migration Toolkit for Containers 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| multicluster engine for Kubernetes 2.11 1786911977 | earliest → < 1786911977 | 1786911977 |
| multicluster engine for Kubernetes 2.17 1786668856 | earliest → < 1786668856 | 1786668856 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 1786908361 | earliest → < 1786908361 | 1786908361 |
| Red Hat Advanced Cluster Management for Kubernetes 2.17 1787335105 | earliest → < 1787335105 | 1787335105 |
| Red Hat OpenShift AI 3.4 1787121387 | earliest → < 1787121387 | 1787121387 |
| Red Hat Openshift Data Foundation 4.18 1786706880 | earliest → < 1786706880 | 1786706880 |
| Red Hat Openshift Data Foundation 4.19 1786703143 | earliest → < 1786703143 | 1786703143 |
| Red Hat Openshift Data Foundation 4.2 1786629548 | earliest → < 1786629548 | 1786629548 |
| Cluster Observability Operator 1.5.2 1787597621 | earliest → < 1787597621 | 1787597621 |
| Cluster Observability Operator 1.5.0 1787597621 | earliest → < 1787597621 | 1787597621 |
| Red Hat Openshift Data Foundation 4.20 1786629548 | earliest → < 1786629548 | 1786629548 |
| Red Hat AMQ Broker 7.13.6 | Versions not published | |
| Red Hat AMQ Broker 7.14.1 | Versions not published |
References
- github.com github.com
- cna.openjsf.org cna.openjsf.org
Timeline
- Published
- Last modified
Other CVEs of fast-uri
The 17 CVEs of fast-uri →
CVE-2026-110725
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
3.7
Low
CVE-2026-110306
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
6.1
Medium
CVE-2026-110180
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
4.8
Medium
CVE-2026-110095
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
3.7
Low