Impact
fast-uri decodes a hostname's percent escapes twice in a single normalize() or resolve() call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so normalize('http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/') returns http://localhost/. Applications that normalize or resolve an untrusted URI before an SSRF check, redirect validation, or host allowlist can be steered to a different destination, including internal addresses such as loopback or a cloud metadata endpoint, than the encoded input appeared to contain. This is an incomplete-fix variant of CVE-2026-6322, whose encoded-authority-delimiter fix introduced the second decode.
Patches
Fixed in fast-uri 2.4.5, 3.1.6, and 4.1.3.
Workarounds
Reject untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to normalize() or resolve().
References
NotAFlightRisk Reporter
mcollina Remediation developer
UlisesGascon Remediation reviewer
Impact
fast-uridecodes a hostname's percent escapes twice in a singlenormalize()orresolve()call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, sonormalize('http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/')returnshttp://localhost/. Applications that normalize or resolve an untrusted URI before an SSRF check, redirect validation, or host allowlist can be steered to a different destination, including internal addresses such as loopback or a cloud metadata endpoint, than the encoded input appeared to contain. This is an incomplete-fix variant of CVE-2026-6322, whose encoded-authority-delimiter fix introduced the second decode.Patches
Fixed in
fast-uri2.4.5, 3.1.6, and 4.1.3.Workarounds
Reject untrusted URIs whose host component contains an encoded percent sign (
%25) before passing them tonormalize()orresolve().References