fast-uri vulnerable to host confusion via failed IDN canonicalization

🗓️ 21 Jul 2026 19:03:11Reported by GitHub Advisory DatabaseType

Fast-uri versions 2.3.1–4.0.0 fail to canonicalize IDN hosts, causing host confusion and policy desync.

Reporter	Title	Published	Views	Family All 277
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	20 Jul 202615:47	–	ibm
IBM Security Bulletins	Security Bulletin:Multiple security vulnerabilities in IBM Process Automation Manager Open Edition Starter Kit for Banking	10 Aug 202609:53	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-13676)	3 Sep 202619:07	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilitie	24 Jul 202615:43	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs	3 Aug 202608:19	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	3 Sep 202616:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Bob Premium Package for i is affected by multiple vulnerabilities	7 Aug 202600:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub	7 Aug 202616:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in fast-ur affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:10	–	ibm
ATTACKERKB	CVE-2026-13676	29 Jun 202613:22	–	attackerkb

Vulners

Node

openjsf fast-uriRange2.3.1–2.4.2npm

openjsf fast-uriRange3.0.0–3.1.3npm

openjsf fast-uriRange4.0.0–4.0.1npm

Source	Link
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-13676
github	www.github.com/fastify/fast-uri/pull/188
github	www.github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05
github	www.github.com/fastify/fast-uri/commit/21ea1f9d70495c931f55dff893a8fa38f4f2e6bd
github	www.github.com/fastify/fast-uri/commit/01db48010f594b98f7b323be18b393791c66ed1d
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json
github	www.github.com/fastify/fast-uri/releases/tag/v4.0.1
github	www.github.com/fastify/fast-uri/releases/tag/v3.1.3
github	www.github.com/fastify/fast-uri/releases/tag/v2.4.2

04 Sep 2026 15:36Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.17.5

EPSS0.00384

SSVC