Bug 2533679 (CVE-2026-86472)

Summary: CVE-2026-86472 fast-uri: fast-uri: Security bypass due to inconsistent host case normalization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aadhikar, abarbaro, abrianik, akhatavk, alizardo, anpicker, anthomas, aos-team-art-private, aruklets, asdas, ataylor, bbrownin, bparees, brasmith, bsmejkal, cdrage, cmyers, cochase, csuconic, dbruscin, dhanak, dnakabaa, doconnor, dpaolell, dranck, drosa, dschmidt, dsimansk, dymurray, ehelms, ehugonne, ewittman, ggainey, ggrzybek, gparvin, gtully, hasun, ibolton, jachapma, janstey, jbalunas, jchui, jdelft, jfula, jhe, jlanda, jmatthew, jmontleo, jowilson, jpasqual, jraez, jsherman, jupierce, juwatts, jwong, kaycoth, kingland, kshier, ktsao, kvanderr, lchilton, lcouzens, lgarciaa, lryznaro, mbiarnes, mdellweg, mhulan, mnovotny, mreynolds, msauton, mstipich, nboldt, nipatil, nmoumoul, nyancey, oaljalju, omaciel, ometelka, osousa, pantinor, parichar, pcreech, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, progier, psrna, ptisnovs, rchan, rexwhite, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rkubis, rushinde, sausingh, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, snegrini, spichugi, sseago, stcannon, sthirugn, suppawar, syedriko, tasato, tbish, tbordaz, teagle, tlavocat, tmalecek, tsze, ttakamiy, vashirov, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in fast-uri, a dependency-free URI parser. This vulnerability occurs because the software folds the host to lowercase before percent-decoding it, allowing percent-encoded uppercase characters to bypass this normalization. A remote attacker could exploit this by crafting a malicious URI with a percent-encoded uppercase octet, potentially bypassing host allowlists or denylists in applications that rely on fast-uri's output for case-sensitive host decisions. This could lead to a security bypass, allowing access to restricted resources or services.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2537700, 2537701, 2537702, 2537705, 2537706, 2537707, 2537708, 2537709, 2537710, 2537711, 2537712, 2537713, 2537703, 2537704    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-15 10:42:42 UTC 
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.