Unleash / unleash / 29906639342

87%

master: 91%

push

github

chore(deps): update dependency fast-uri to v3.1.4 [security] (#12487)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [fast-uri](https://redirect.github.com/fastify/fast-uri) | [`3.1.3` →
`3.1.4`](https://renovatebot.com/diffs/npm/fast-uri/3.1.3/3.1.4) |
![age](https://developer.mend.io/api/mc/badges/age/npm/fast-uri/3.1.4?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-uri/3.1.3/3.1.4?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### fast-uri vulnerable to host confusion via literal backslash
authority delimiter
[CVE-2026-16221](https://nvd.nist.gov/vuln/detail/CVE-2026-16221) /
[GHSA-v2hh-gcrm-f6hx](https://redirect.github.com/advisories/GHSA-v2hh-gcrm-f6hx)

<details>
<summary>More information</summary>

#### Details
##### Impact

`fast-uri` v4.1.0 and earlier do not treat a literal backslash (U+005C)
as an authority delimiter. Node's native WHATWG `URL` (used by
`fetch()`, `undici`, and Node's `http`/`https` clients) normalizes `\`
to `/` for special schemes (`http`, `https`, `ws`, `wss`, `ftp`,
`file`), so the two parsers extract different hosts from the same input
string.

For example, `http://evil.com\@&#8203;allowed.com` is treated by
`fast-uri` as host `allowed.com` with userinfo `evil.com\`, while Node's
WHATWG URL parser and `fetch()` see host `evil.com` with path
`/@&#8203;allowed.com`.

Applications that use `fast-uri` to enforce host-based policy
(allowlists, denylists, loopback/SSRF filtering, redirect validation,
outbound proxy routing) before passing the same URL into Node's URL or
`fetch()` consumers see a policy/use desync and can be steered to an
unintended destination, including cloud metadata endpoints, loopback, or
internal hosts.

###... (continued)

1965 of 2164 branches covered (90.8%)

15666 of 17925 relevant lines covered (87.4%)

812.99 hits per line