Search: CVE-2026-75931

fast-uri, a URI parser for Node.js used in node-ajv, inconsistently canonicalizes hosts depending on whether the URI includes an explicit scheme. This inconsistency can cause host confusion, allowing policy bypass when applications compare hosts extracted by different fast-uri functions. The vulnerability affects versions 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. Fixed versions 2.4.5, 3.1.6, and 4.1.3 address the issue by consistent host canonicalization. Users should upgrade to these patched versions to mitigate the risk.