Improper Handling of Case Sensitivity

🗓️ 15 Sep 2026 10:29:50Reported by Snyk Security DatabaseType

fast-uri host case normalization inconsistency allows allowlist bypass via percent-encoded uppercase.

Reporter	Title	Published	Views	Family All 320
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules	22 Oct 202614:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Test Accelerator for Z uses fast-uri-3.1.7.tgz, which is vulnderable to CVE-2026-86472	30 Oct 202623:19	–	ibm
IBM Security Bulletins	Security Bulletin: Automation Assets in IBM Integration is vulnerable to multiple vulnerabilities in fast-uri	20 Oct 202610:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in fast-uri (CVE-2026-84292, CVE-2026-84394, CVE-2026-86472)	26 Oct 202620:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Angular router and fast-uri libraries.	28 Oct 202611:06	–	ibm
Chainguard	CVE-2026-86472 vulnerabilities	1 Oct 202602:55	–	cgr
Circl	CVE-2026-86472	15 Sep 202610:34	–	circl
CVE	CVE-2026-86472	15 Sep 202610:29	–	cve
Cvelist	CVE-2026-86472 fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets	15 Sep 202610:29	–	cvelist
Debian CVE	CVE-2026-86472	15 Sep 202610:29	–	debiancve