Answer in brief
CVE-2026-13676 records a High severity (CVSS 7.5) vulnerability in fast-uri vulnerable to host confusion via failed IDN canonicalization. The current sources do not mark it as known exploited. The current feed maps fast-uri/fast-uri (generic), fast-uri (npm), fast-uri (npm), fast-uri (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps fast-uri/fast-uri (generic), fast-uri (npm), fast-uri (npm), fast-uri (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| fast-uri/fast-urigeneric | >=4.0.0 <4.0.1 || >=2.3.1 <3.1.3 | 4.0.1, 3.1.3 |
| fast-urinpm | >=2.3.1,<2.4.2 | 2.4.2 |
| fast-urinpm | >=4.0.0,<4.0.1 | 4.0.1 |
| fast-urinpm | >=3.0.0,<3.1.3 | 3.1.3 |
| fast-urinpm | >=4.0.0 <4.0.1 | 4.0.1 |
| fast-urinpm | >=3.0.0 <3.1.3 | 3.1.3 |
| fast-urinpm | >=2.3.1 <2.4.2 | 2.4.2 |
Published upstream
Jun 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 29, 2026
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.
Quoted source text, attributed separately from HOL analysis.