CVE-2026-75931
Publiée le 2026-08-24 · Dernière modification le 2026-10-14
Les applications Node.js utilisant la bibliothèque `fast-uri` pour l'analyse des URI sont concernées. Un attaquant peut utiliser des URL « relatives au schéma » spécifiquement conçues (commençant par `//`) pour tromper votre application et contourner les politiques de sécurité basées sur l'hôte, redirigeant potentiellement les requêtes vers une destination malveillante. Cette action peut être exécutée à distance via le réseau, sans aucune authentification ni interaction de l'utilisateur.
DÉTAIL DU VECTEUR CVSS
RÉFÉRENCES
Description officielle du NVD (en anglais)
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a patched version.