{"uuid": "370492a4-733d-4881-9837-251a006095bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86472", "type": "seen", "source": "https://gist.github.com/alon710/88f917dec8f03c60e71606b2529f278c", "content": "# CVE-2026-86472: CVE-2026-86472: Hostname Canonicalization Bypass in fast-uri via Scheme-Relative URLs\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86472\n\n## Summary\nCVE-2026-86472 is a validation bypass vulnerability in fast-uri (a high-performance RFC 3986 URI toolbox heavily used by popular Node.js frameworks like Fastify and validation libraries like AJV). The vulnerability stems from improper handling of case sensitivity (CWE-178) due to an incorrect order of operations during hostname canonicalization in scheme-relative URLs. An attacker can leverage percent-encoded uppercase characters within scheme-relative URLs to bypass domain blocklists/allowlists in downstream applications. Because hostname resolution in DNS and HTTP is case-insensitive, the bypassed host representation still routes to the target destination, resulting in potential Server-Side Request Forgery (SSRF) or security control bypasses.\n\n## TL;DR\nAn incorrect sequence of case folding and percent-decoding in fast-uri allows attackers to bypass case-sensitive domain filters using percent-encoded uppercase hostnames in scheme-relative URLs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-178\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 4.8\n- **EPSS Score**: 0.00253\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-uri < 2.4.7\n- fast-uri 3.x < 3.1.8\n- fast-uri 4.x < 4.1.5\n- **fast-uri**: < 2.4.7 (Fixed in: `2.4.7`)\n- **fast-uri**: 3.0.0 - 3.1.7 (Fixed in: `3.1.8`)\n- **fast-uri**: 4.0.0 - 4.1.4 (Fixed in: `4.1.5`)\n\n## Mitigation\n\n- Upgrade fast-uri dependency to patched versions.\n- Enforce manual lowercasing on all parsed hostname outputs before comparison.\n- Deploy Web Application Firewall rules to detect and drop scheme-relative URLs with percent-encoded characters.\n\n**Remediation Steps:**\n1. Check project dependency tree for fast-uri versions using `npm ls fast-uri`.\n2. Apply package overrides or resolutions in package.json to force safe versions.\n3. Run `npm install` or `yarn install` to update lockfiles with patched versions (2.4.7, 3.1.8, or 4.1.5).\n4. Verify parsed output normalization by adding test cases for '//%41.com' in the integration suite.\n\n## References\n\n- [GitHub Security Advisory GHSA-hrr3-gc8f-f4qj](https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD Entry CVE-2026-86472](https://nvd.nist.gov/vuln/detail/CVE-2026-86472)\n- [CVE Record CVE-2026-86472](https://www.cve.org/CVERecord?id=CVE-2026-86472)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86472) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T01:30:28.000000Z"}