CVE-2026-6322: Verified Repro With Script Download

Summary

fast-uri's normalize() function decodes percent-encoded authority delimiter characters (specifically @) that appear inside the host component and then re-emits them as raw characters. When an attacker supplies a URI such as https://allowed.com%40attacker.com/, the vulnerable build decodes %40 to @, producing https://allowed.com@attacker.com/. Under RFC 3986 authority syntax, the text before @ is reinterpreted as userinfo and the effective host becomes attacker.com. This host confusion defeats any host-allowlist, SSRF guard, or redirect-validation logic built on top of normalize().

Impact

• Package: fast-uri (npm)
• Affected versions: <= 3.1.1
• Fixed version: 3.1.2
• Risk level: High (CVSS 7.5)
• Consequences: SSRF bypass, open-redirect bypass, and general defeat of URI-based access controls that rely on normalized host values.

Root Cause

In fast-uri <= 3.1.1, the parse() function unconditionally calls unescape(parsed.host) during normalization. unescape() decodes all percent-encoded sequences, including RFC 3986 "gen-delims" such as @, :, /, ?, and #. These delimiters are structurally significant in the authority component. After decoding, serialize() / recomposeAuthority() re-emits them as raw characters, changing the parsed structure of the URI.

The fix in 3.1.2 introduces reescapeHostDelimiters() in lib/utils.js. After unescape() runs on the host, this new function scans for decoded gen-delims and re-escapes them (@ → %40, : → %3A, etc.). Additionally, normalizeStringWithStatus() detects malformed authorities or out-of-range ports and, when found, returns the original input unchanged rather than canonicalizing it into a different valid URI. The key fix commit is the v3.1.1..v3.1.2 tag range in the fastify/fast-uri repository.

Reproduction Steps

1. Run repro/reproduction_steps.sh.
2. The script installs fast-uri@3.1.1 (vulnerable) and fast-uri@3.1.2 (fixed) into isolated scratch directories.
3. It invokes normalize('https://allowed.com%40attacker.com/') against both versions and parses the resulting URI.
4. Expected evidence:
   • Vulnerable (3.1.1): normalized URI is https://allowed.com@attacker.com/, parsed host = attacker.com, parsed userinfo = allowed.com.
   • Fixed (3.1.2): normalized URI is https://allowed.com%40attacker.com/, parsed host = allowed.com%40attacker.com, parsed userinfo = undefined.

Evidence

• Log files:
  • logs/vuln_result.json — captured result from the vulnerable build.
  • logs/fixed_result.json — captured result from the fixed build.
• Key excerpts from reproduction run:

  VULNERABLE BUILD (3.1.1)
    Normalized URI:  https://allowed.com@attacker.com/
    Parsed host:     attacker.com
    Parsed userinfo: allowed.com
  
  FIXED BUILD (3.1.2)
    Normalized URI:  https://allowed.com%40attacker.com/
    Parsed host:     allowed.com%40attacker.com
    Parsed userinfo: undefined
  

• Environment: Node.js (npm-based) running on Linux with fast-uri installed from the public npm registry.

Recommendations / Next Steps

• Upgrade immediately to fast-uri@3.1.2 or later.
• If upgrading is not possible: wrap normalize() output with an additional parse-and-validate step that rejects any host containing @ or other authority delimiters after normalization.
• Testing recommendations: add regression tests for percent-encoded delimiters inside the host (%40, %3A, %2F, %3F, %23) to ensure they remain escaped through normalize(), parse(), serialize(), and equal().

Additional Notes

• The reproduction script is idempotent: it passed two consecutive runs without modification.
• Edge cases tested implicitly by the fix include double-encoded sequences (%2540 → %40, not @) and IPv6 hosts where colon re-escaping is skipped.
• The equal() function was also hardened in 3.1.2 to return false when either input is malformed, preventing accidental equivalence between trusted.com%40evil.com and trusted.com@evil.com.