chore(deps): update dependency fast-uri to v3.1.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fast-uri	3.1.5 → 3.1.6

---

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

CVE-2026-75931 / GHSA-5jgf-p345-68v8

More information

Details

Impact

fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve() resolves a scheme-relative reference (//host/) against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved URI yields a different host than the one resolve() returned. An application that resolves an untrusted reference with fast-uri and then checks or routes on the resulting host can make a policy decision on one host and reach another. This is an incomplete-fix variant of CVE-2026-13676, whose IDN canonicalization was applied only to the scheme-bearing form.

Patches

Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. resolve() now canonicalizes the host once the effective scheme is known, and fails closed if a raw non-ASCII host cannot be converted.

Workarounds

Resolve scheme-relative references against a base that carries a scheme before performing any host-policy or origin check.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8
• https://nvd.nist.gov/vuln/detail/CVE-2026-75931
• https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5
• https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef
• https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.5
• https://github.com/fastify/fast-uri/releases/tag/v3.1.6
• https://github.com/fastify/fast-uri/releases/tag/v4.1.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

CVE-2026-75975 / GHSA-f65p-4m7j-42xc

More information

Details

Impact

fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize('http://[::not-valid]/private') returns http://[::]/private, and [fc00::not-hex] and [fe80::not-hex] collapse to [fc00::] and [fe80::]. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (::1), unique-local, or link-local. Because parse().error is unset for these inputs, checking it does not protect the consumer.

Patches

Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. Malformed IPv6 literals are now rejected with a host error instead of being normalized to a valid address.

Workarounds

Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri, or route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc
• https://nvd.nist.gov/vuln/detail/CVE-2026-75975
• https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595
• https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f
• https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.5
• https://github.com/fastify/fast-uri/releases/tag/v3.1.6
• https://github.com/fastify/fast-uri/releases/tag/v4.1.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

CVE-2026-75899 / GHSA-fph4-wmhf-6fwf

More information

Details

Impact

fast-uri decodes a hostname's percent escapes twice in a single normalize() or resolve() call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so normalize('http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/') returns http://localhost/. Applications that normalize or resolve an untrusted URI before an SSRF check, redirect validation, or host allowlist can be steered to a different destination, including internal addresses such as loopback or a cloud metadata endpoint, than the encoded input appeared to contain. This is an incomplete-fix variant of CVE-2026-6322, whose encoded-authority-delimiter fix introduced the second decode.

Patches

Fixed in fast-uri 2.4.5, 3.1.6, and 4.1.3.

Workarounds

Reject untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to normalize() or resolve().

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf
• https://nvd.nist.gov/vuln/detail/CVE-2026-75899
• https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f
• https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304
• https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.5
• https://github.com/fastify/fast-uri/releases/tag/v3.1.6
• https://github.com/fastify/fast-uri/releases/tag/v4.1.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

CVE-2026-76172 / GHSA-jqff-g426-hqxp

More information

Details

Impact

fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape() and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore introduce structure the original input did not contain.

For example, %2f%2fevil.example:/pwn parses with no authority (parse().host is undefined), but resolve() and normalize() return //evil.example:/pwn, which reparses with host evil.example. The %uXXXX form (%u002f%u002fevil.example:/pwn) produces the same result, and a scheme containing %0d%0a reaches the output as a raw CR LF.

Applications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision, especially ones that treat a missing authority as same-origin, can be steered to an attacker-chosen authority, and a normalized URI placed in a response header can carry an injected CR LF.

Patches

Upgrade to fast-uri >= 4.1.3, or >= 3.1.6 in the v3.x release line, or >= 2.4.5 in the v2.x release line.

Workarounds

None. Upgrade to the patched version.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp
• https://nvd.nist.gov/vuln/detail/CVE-2026-76172
• https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862
• https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b
• https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.5
• https://github.com/fastify/fast-uri/releases/tag/v3.1.6
• https://github.com/fastify/fast-uri/releases/tag/v4.1.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fast-uri (fast-uri)

v3.1.6

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.