Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-06-29T13:22:44
fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-551
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.
A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.
This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat Edge Manager 1.1
2026-07-16T00:00:00Z
RHSA-2026:40945
rhem/flightctl-ui-ocp-rhel10:1784194938
Red Hat Edge Manager 1.1
2026-07-16T00:00:00Z
RHSA-2026:40945
rhem/flightctl-ui-rhel10:1784194574
Red Hat Edge Manager 1.1
2026-07-15T00:00:00Z
RHSA-2026:40118
rhem/flightctl-ui-ocp-rhel9:1784126822
Red Hat Edge Manager 1.1
2026-07-15T00:00:00Z
RHSA-2026:40118
rhem/flightctl-ui-rhel9:1784127736
Red Hat OpenShift Container Platform 4.2
2026-07-14T00:00:00Z
RHSA-2026:37628
openshift4/ose-monitoring-plugin-rhel9:1783596795
Red Hat OpenShift Container Platform 4.21
2026-07-14T00:00:00Z
RHSA-2026:37186
openshift4/ose-monitoring-plugin-rhel9:1783510956
Red Hat OpenShift Container Platform 4.22
2026-07-14T00:00:00Z
RHSA-2026:37585
openshift4/ose-monitoring-plugin-rhel9:1783559447
Red Hat Quay 3.16
2026-07-16T00:00:00Z
RHSA-2026:41066
quay/quay-rhel9:1783955846
Red Hat Quay 3.9
2026-07-15T00:00:00Z
RHSA-2026:40262
quay/quay-rhel8:1784125838
Confidential Compute Attestation
Affected
openshift-sandboxed-containers/osc-pccs
Cryostat 4
Not affected
cryostat-openshift-console-plugin-npm
Cryostat 4
Not affected
grafana-infinity-datasource-npm
Migration Toolkit for Applications 8
Affected
mta/mta-solution-server-rhel9
Migration Toolkit for Containers
Affected
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Affected
multicluster-engine/console-mce-rhel9
Network Observability Operator
Affected
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Affected
network-observability/network-observability-console-plugin-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-agentic-console-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-transform-jsonata-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Affected
rhacm2/console-rhel9
Red Hat AMQ Broker 7
Affected
fast-uri
Red Hat Ansible Automation Platform 2
Will not fix
ansible-automation-platform-24/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Will not fix
ansible-automation-platform-25/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Will not fix
ansible-automation-platform-26/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Will not fix
ansible-automation-platform-27/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-27/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-tech-preview/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Affected
automation-gateway
Red Hat Ansible Automation Platform 2
Affected
automation-platform-ui
Red Hat build of Apache Camel - HawtIO 4
Affected
fast-uri
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Podman Desktop
Affected
rh-podman-desktop.git
Red Hat Connectivity Link 1
Affected
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Will not fix
fast-uri
Red Hat Developer Hub
Affected
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Affected
discovery/discovery-ui-rhel9
Red Hat Enterprise Linux 10
Affected
linux-sgx
Red Hat Enterprise Linux 9
Affected
linux-sgx
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/disk-image-cuda-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/nmstate-console-plugin-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/mcg-core-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/dashboard-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Satellite 6
Not affected
nodejs-compression-webpack-plugin
Red Hat Satellite 6
Not affected
nodejs-mini-css-extract-plugin
Red Hat Satellite 6
Not affected
nodejs-webpack
Red Hat Satellite 6
Affected
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Affected
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Affected
satellite/iop-remediations-rhel9
Red Hat Satellite 6
Affected
satellite/iop-vulnerability-frontend-rhel9
Self-service automation portal 2
Affected
ansible-automation-platform/automation-portal
Self-service automation portal 2
Affected
ansible-automation-platform/bootc-automation-portal-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-13676
https://nvd.nist.gov/vuln/detail/CVE-2026-13676
https://cna.openjsf.org/security-advisories.html
https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6