Vulnerabilidad · Publicado 03/09/2026
fast-uri acepta hosts con corchetes de autoridad desbalanceados o mal posicionados sin generar error, lo que permite que URLs malformadas se procesen incorrectamente. Esto afecta aplicaciones Node.js que utilizan esta librería para parsear URLs, potencialmente permitiendo evasión de validaciones de seguridad en servidores web, proxies y clientes HTTP. El riesgo es alta en empresas LATAM que procesan URLs no confiables sin validación adicional.
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.
Score: 7.5/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-436
Publicado en NIST NVD.