Impact
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example, serializing a component whose port is @127.0.0.1:8124 produces http://trusted.example:@127.0.0.1:8124/app, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it.
This affects applications that build URIs from parts and assign untrusted data to the port component (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable through serialize(), normalize(), and equal() in their object forms. A port obtained from parse() is always digits and is not affected.
Patches
This vulnerability has been patched in fast-uri 4.1.4, 3.1.7, and 2.4.6. recomposeAuthority now rejects any port that is not *DIGIT per RFC 3986. All users should upgrade.
Workarounds
If upgrading is not immediately possible, validate the port value against the RFC 3986 grammar (digits only) before passing a component to serialize(), normalize(), or equal(), and reject anything else, for example if (!/^\d*$/.test(String(port))) throw new Error('invalid port').
References
YashvantHange Reporter
mcollina Remediation developer
UlisesGascon Remediation reviewer
Impact
fast-uriserializes theportcomponent of a URI without validating it. When recomposing the authority,fast-uriescapes the userinfo and host components but concatenates the port verbatim, so aportvalue that is not a sequence of digits can inject authority delimiters. For example, serializing a component whoseportis@127.0.0.1:8124produceshttp://trusted.example:@127.0.0.1:8124/app, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Bothfast-uriand Node'sURLread the result back as the attacker's host with no error, so re-validating the built URI does not catch it.This affects applications that build URIs from parts and assign untrusted data to the
portcomponent (for example a fixed host from configuration and a port taken from user input or a service record). The same path is reachable throughserialize(),normalize(), andequal()in their object forms. Aportobtained fromparse()is always digits and is not affected.Patches
This vulnerability has been patched in fast-uri
4.1.4,3.1.7, and2.4.6.recomposeAuthoritynow rejects any port that is not*DIGITper RFC 3986. All users should upgrade.Workarounds
If upgrading is not immediately possible, validate the
portvalue against the RFC 3986 grammar (digits only) before passing a component toserialize(),normalize(), orequal(), and reject anything else, for exampleif (!/^\d*$/.test(String(port))) throw new Error('invalid port').References