Search: CVE-2026-86472

fast-uri, a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv, has a vulnerability in versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4. The parser incorrectly handles percent-encoded uppercase octets in the host component by folding the host to lowercase before decoding, causing inconsistencies in host normalization. This can allow bypass of case-sensitive host allowlist or denylist checks, potentially permitting unauthorized access. The issue is fixed in versions 2.4.7, 3.1.8, and 4.1.5 and later. Users should upgrade or apply a workaround by performing case-insensitive host comparisons.