Node ajv: fast-uri is a URI parser for Node.js. (CVE-2026-75931)

The fast-uri library for Node.js has a vulnerability (CVE-2026-75931) where it only canonicalizes a host to its ASCII form if the input URI includes an explicit scheme. Scheme-relative references (e.g., starting with //) are returned with the host verbatim and no error, causing different fast-uri functions (parse, resolve, normalize, equal) to produce inconsistent host values for the same input. This inconsistency can lead to host confusion and policy bypass if an application uses fast-uri to check hosts against a policy list and then resolves the same reference differently. The vulnerability affects node-ajv versions 2.4.2 to <2.4.5, 3.1.3 to <3.1.6, and 4.0.1 to <4.1.3. The issue is fixed in versions 2.4.5, 3.1.6, and 4.1.3 by ensuring consistent host canonicalization across all resolve paths.

The vulnerability enables host confusion and policy bypass in applications using fast-uri to enforce host-based policies. An attacker could exploit the inconsistent host canonicalization to bypass security checks that rely on host matching, potentially leading to unauthorized access or other policy violations. The CVSS score is 7.5 (High), reflecting the potential for integrity impact without requiring privileges or user interaction.

A fix is available in fast-uri versions 2.4.5, 3.1.6, and 4.1.3, which consistently canonicalize hosts across all functions. Users should upgrade node-ajv to these patched versions to remediate the vulnerability. No other mitigation is indicated by the vendor advisory.