fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-86472 · CVE overview and exploitation status

EUVD-2026-78395

GHSA-hrr3-gc8f-f4qj

cve-program · CVE-2026-86472

• https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-78395

• https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-86472

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj

osv · GHSA-hrr3-gc8f-f4qj

• https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj
• https://nvd.nist.gov/vuln/detail/CVE-2026-86472
• https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.7
• https://github.com/fastify/fast-uri/releases/tag/v3.1.8
• https://github.com/fastify/fast-uri/releases/tag/v4.1.5

• fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the hos… · Advisory content revised · 9 Nov 2026