18 matches found
CVE-2026-110180
A flaw was found in fast-uri. When processing web addresses, the host canonicalization mechanism can silently strip control characters or drop user information without verifying that the full host input was consumed. A remote attacker can exploit this parsing discrepancy by supplying a specially...
CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...
SUSE CVE-2026-86472
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...
CVE-2026-86472
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...
PT-2026-91922
Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.7 fast-uri versions 3.0.0 through 3.1.7 fast-uri versions 4.0.0 through 4.1.4 Description The software folds the host to lowercase before percent-decoding it. Consequently, a percent-encoded uppercase octet, such...
CVE-2026-86472: Improper Handling of Case Sensitivity
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...
UBUNTU-CVE-2026-75931
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...
CVE-2026-75931
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...
CVE-2026-13676 fast-uri vulnerable to host confusion via failed IDN canonicalization
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize and equal still return...
EulerOS 2.0 SP11 : util-linux (EulerOS-SA-2026-2268)
According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in util-linux. Improper hostname canonicalization in the login1 utility, when invoked with the -h option, can modify the...
EUVD-2020-17717
Malware in sbrugna...
SUSE CVE-2020-25018
Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization...
CVE-2020-25018
Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization...
CVE-2020-25018
Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization...
CVE-2020-25018
Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization...
CVE-2020-25018
CVE-2020-25018 concerns Envoy: a vulnerability in the Envoy master between commits 2d69e30 and 3b5acb2 where parsing of URLs requiring host canonicalization may fail. The issue is tied to host normalization during request handling, with multiple connected documents noting exposure leading to an a...
PT-2020-15893
Name of the Vulnerable Software and Affected Versions Envoy versions between 2d69e30 and 3b5acb2 Description The issue is related to the parsing of request URLs that require host canonicalization. Recommendations For versions between 2d69e30 and 3b5acb2, update to a version outside of this range ...