Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: fastify/fast-uri
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v3.1.4
Choose a base ref
...
head repository: fastify/fast-uri
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v3.1.5
Choose a head ref
  • 2 commits
  • 3 files changed
  • 2 contributors

Commits on Jul 31, 2026

  1. Merge commit from fork 

    * fix: reject malformed authority introducer (\, /\, \/) to prevent host-confusion

Adds MALFORMED_AUTHORITY_INTRODUCER regex and check in parseWithStatus()
to detect "\\", "/\", and "\/" used as authority introducers in place
of "//" after the scheme colon. Node's URL treats "\" as interchangeable
with "/" on special schemes, so these inputs would parse as a different
host — an SSRF/redirect bypass gap distinct from the previously-patched
literal-backslash-in-authority fix (GHSA-v2hh-gcrm-f6hx).

Also makes resolve() throw on malformed authority or port, since it
returns a plain string with no error-signal mechanism.

Adds 23 regression tests covering rejection, normalization, equal(),
resolve(), and no false positives.

* fix: reject whitespace-split authority introducer (TAB/LF/CR) host-confusion bypass

---------

Co-authored-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
    @mcollina @UlisesGascon
    mcollina and UlisesGascon committed Jul 31, 2026
    Configuration menu
    Copy the full SHA
    2cad02d View commit details
    Browse the repository at this point in the history

  2. Bumped v3.1.5 

    Signed-off-by: Matteo Collina <hello@matteocollina.com>
    @mcollina
    mcollina committed Jul 31, 2026
    Configuration menu
    Copy the full SHA
    5e179cb View commit details
    Browse the repository at this point in the history
Loading