Node ajv: fast-uri is a URI parser for Node.js. (CVE-2026-76172)

fast-uri for Node.js performs a legacy decoding pass on the URI scheme component without re-escaping the result, unlike the host component. This causes inputs with percent-encoded slashes in the scheme to parse as having no authority, resulting in undefined host and error values. However, resolving or normalizing such inputs emits a network-path reference with an attacker-controlled authority, which re-parses to that host. Applications that allowlist based on the parsed host or treat references with no authority as safe may be vulnerable to off-site redirects, server-side request forgery, or address-policy bypass. Additionally, the legacy decoder expands non-standard escape forms and allows control characters like carriage return and line feed to appear in output. The vulnerability affects versions 2.3.1 to <2.4.5, 3.0.0 to <3.1.6, and 4.0.0 to <4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3 by rejecting schemes invalid after decoding.

This vulnerability can lead to security bypasses such as off-site redirects, server-side request forgery (SSRF), and address-policy bypasses due to incorrect URI parsing and validation. Applications relying on parsed host allowlisting or assumptions about authority presence may be tricked into unsafe behavior. The flaw does not impact confidentiality but can cause integrity issues by allowing attacker-controlled URIs to bypass filters.

Upgrade fast-uri to versions 2.4.5, 3.1.6, or 4.1.3 or later, where the vulnerability is fixed by rejecting invalid schemes after decoding. No other mitigations are indicated by the vendor advisory. Users should ensure they are not using affected versions.