fast-uri Host Confusion Vulnerability via Literal Backslash Authority Delimiter

A host confusion vulnerability has been identified in fast-uri versions 2.3.1 prior to 2.4.2, 3.0.0 prior to 3.1.3, and 4.0.0 prior to 4.1.0. The vulnerability arises because these versions do not recognize a literal backslash character as an authority delimiter. This oversight leads to a discrepancy when compared to Node's native WHATWG URL parser, which normalizes backslashes to forward slashes for certain schemes like http, https, ws, wss, ftp, and file. Consequently, the two parsers can extract different hosts from the same input string. Applications using fast-uri to enforce host-based policies—such as allowlists, denylists, loopback or Server-Side Request Forgery (SSRF) filtering, redirect validation, or outbound proxy routing—may be misled to unintended destinations, including cloud metadata endpoints, loopback, or internal hosts.

Impact

Exploitation of this vulnerability can cause host-based policy enforcement to fail, allowing URLs to be redirected to unintended destinations, such as internal or loopback addresses, potentially leading to unauthorized access or data exposure.

Remediation

Users are advised to upgrade to fast-uri versions 4.1.1, 3.1.4, or 2.4.3.