CVE-2026-13676

Aliases:GHSA-4c8g-83qw-93j6DEBIAN-CVE-2026-13676CGA-837h-h952-wp47CGA-9m4x-g95g-pmxhCGA-f85r-3jh4-f927CGA-f8j2-8rhf-93v5CGA-fjm7-2p9p-hv82CGA-j6fp-jcfm-4m98CGA-mmh4-58m4-h4xmCGA-mpgh-5qph-c85jCGA-mvrh-5fp4-vh2vCGA-phm5-5fhh-vr74CGA-22v3-55hg-rxqgCGA-255q-wr88-2mwhCGA-263h-h7rw-m238CGA-298g-52jh-wc6cCGA-2c3v-gcm3-g5rcCGA-2fx9-3hgq-6hj4CGA-2hf7-g5c8-9f2gCGA-2p2w-crx2-f23gCGA-2r29-rghv-w489CGA-2rqf-xh88-gwvjCGA-2v3w-5v79-j297CGA-338p-f6mq-qc3jCGA-363x-4w3x-pmj8CGA-36jr-4pwh-6q65CGA-3h4p-jvjm-ggrrCGA-3hw9-vjf8-4q46CGA-427x-h84p-3p5rCGA-45xg-wwrp-jhx3CGA-48gq-2p73-g6xpCGA-48m2-6xp3-7gwcCGA-49gh-cqrw-cq53CGA-49rw-cp95-jq6cCGA-4g7x-c7g4-2588CGA-4gg8-5mw6-g5hrCGA-4h34-7r4x-x46mCGA-4h63-qhrv-x5g3CGA-4mw2-7fw4-h8cmCGA-4v35-vhc6-8hgrCGA-52mw-r2jm-3x8xCGA-5363-3pxx-q859CGA-5598-j53j-pfv3CGA-55vf-4f64-8vvwCGA-586h-m42p-cr6pCGA-59q6-438r-2wp6CGA-5hpg-3926-rqj7CGA-5m3f-4m4m-wmw9CGA-663v-fvgf-r367CGA-6893-48q4-j88wCGA-6983-28w6-vqx6CGA-6j2w-v2mx-hmjvCGA-6j95-xr27-2rwvCGA-6xgr-85f7-3277CGA-75wj-hxrj-whvgCGA-7f75-xprc-rf5hCGA-7h46-j8wc-p5mmCGA-7j28-jm87-6xp4CGA-7x3f-2q5v-99q3CGA-82pr-3fqg-qw6mCGA-82rc-rh6p-q9vrCGA-833f-4hfr-24hfCGA-83qq-gxfq-gx5vCGA-843v-gcg2-qx66CGA-845j-6737-37frCGA-884h-gxfm-wf7mCGA-8rhf-25hr-9g9rCGA-8v57-hgjg-jmxgCGA-8vgm-cmh6-wvm9CGA-95m8-87h6-9vv5CGA-99xg-72h2-ghx6CGA-9gg7-wg4w-m575CGA-9jrw-4fq7-37rhCGA-9pcv-m4q3-p4j4CGA-9pwc-xxrf-h6q5CGA-9rq8-4947-cpvqCGA-9vj7-rjj2-j3f3CGA-c3hw-gxvx-v5j4CGA-c4vc-hrwh-h5hhCGA-c6jm-x3m5-whp8CGA-ccmv-7479-6jq3CGA-cf2x-66wq-6fphCGA-cfj9-pmm3-9778CGA-cpv7-mpc5-6mqfCGA-cq22-p4h5-wr72CGA-crc8-fm75-q2h8CGA-f8rx-w393-7wp4CGA-f9jf-x4vf-g94wCGA-ff2r-gwh2-3c37CGA-fg8m-38j7-hv8pCGA-fmc9-694r-f2cpCGA-fq89-m968-j29hCGA-fqfq-hvpr-22g4CGA-frc3-27j2-q997CGA-fxp2-g6xc-p7p3CGA-g2vr-qvc3-g74vCGA-g2w4-mwm6-74rrCGA-grx6-gpx8-w757CGA-gx4j-m4qq-qc58CGA-h38c-88cf-f9j9CGA-h47r-246g-g8g5CGA-hw4x-56h2-rwjxCGA-j2jp-5728-4xmhCGA-j2v7-7qpr-73w9CGA-j763-5p9q-cq7mCGA-jgw9-qxm9-297gCGA-jph3-vqpr-qhpjCGA-jv2g-5h63-p6crCGA-jw49-cfmg-2v7hCGA-m3rp-43gf-q79fCGA-m5jh-cwxx-6hxpCGA-m5rx-j6fg-6pmhCGA-m7vf-x5hc-jmxrCGA-m8gh-rxp4-7vm3CGA-mcj8-j6f7-9gcjCGA-mhqh-pjrw-hc7wCGA-mp7c-8vqj-48gqCGA-mv37-w5jf-r74pCGA-mvcm-xxv3-4rxhCGA-mxq4-f8w8-wccxCGA-p2w5-j847-6vp4CGA-p832-pq7p-cwmgCGA-pfcf-g2fc-c7vmCGA-ph6h-998p-f6v5CGA-pjh7-xv6v-5gvfCGA-ppjj-fc95-3hwcCGA-pppw-3j3q-3m5jCGA-prp9-cj6p-v7m4CGA-qcqm-vphj-54m8CGA-qgv6-pf55-553xCGA-qhqw-vch5-4xrwCGA-qj9m-5q2h-7vrjCGA-rf45-7fwx-3fpgCGA-rf9h-3939-xfx2CGA-rj58-r463-3jq9CGA-rphv-g263-3576CGA-rwg5-j7h5-rgqmCGA-v529-qpq4-6hc5CGA-v5xv-9chj-9qvfCGA-vcrj-xwhr-w74fCGA-vm92-4mvg-r2fmCGA-vp86-mp46-23pxCGA-w266-r568-x99wCGA-w86g-3v7r-cwqpCGA-w8hf-67w3-66g6CGA-wfgx-8c3q-4pm8CGA-wjx9-mqpr-3mg3CGA-wpmx-gj73-9gwcCGA-wvg7-3w6q-jr59CGA-x475-6q42-v2wxCGA-x9mf-r3w2-6m8fCGA-xgjc-pp48-qw6fCGA-xh9h-xf34-892fCGA-9vvj-77j5-qm5qCGA-hj2h-99cr-64q2CGA-3w58-m34x-2vjrCGA-6w26-33jm-4ffwCGA-278r-m26x-mj45CGA-3hhc-prcj-qw67CGA-7gq3-45c2-x825CGA-w635-8prm-wfjgCGA-2gg7-9qvx-hjfpCGA-2qxq-43j3-m5qgCGA-jjw7-w528-75hh
Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 29 Jun 2026, 13:22
Last modified:11 Sept 2026, 12:09

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.48% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

29 Jun 2026, 13:22
Published
Vulnerability first disclosed
11 Sept 2026, 12:09
Last Modified
Vulnerability information updated

Description

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.48%• Percentile: 41%

Techniques & Countermeasures

  • CWE-436•Interpretation Conflict

    Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

  • CWE-551•Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

    If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

Affected Systems

  • chainguard•airflow-2

    all

  • chainguard•airflow-core-2

    all

  • chainguard•arangodb-3.12

    < 3.12.9.4-r15

  • chainguard•argo-workflows-ui-4.0

    < 4.0.11-r0

  • chainguard•commercial-gitlab-rails-ee-19.1

    all

  • chainguard•commercial-gitlab-rails-ee-19.2

    all

  • chainguard•commercial-gitlab-rails-ee-19.3

    all

  • chainguard•commercial-gitlab-rails-ee-fips-19.1

    all

  • chainguard•commercial-gitlab-rails-ee-fips-19.2

    all

  • chainguard•commercial-gitlab-rails-ee-fips-19.3

    all

  • chainguard•gitlab-rails-ce-18.1

    < 18.1.6-r36

  • chainguard•gitlab-rails-ce-18.10

    all

  • chainguard•gitlab-rails-ce-18.11

    all

  • chainguard•gitlab-rails-ce-18.6

    all

  • chainguard•gitlab-rails-ce-18.7

    all

  • chainguard•gitlab-rails-ce-18.8

    all

  • chainguard•gitlab-rails-ce-18.9

    all

  • chainguard•gitlab-rails-ce-19.0

    all

  • chainguard•gitlab-rails-ce-19.1

    < 19.1.7-r4

  • chainguard•gitlab-rails-ce-19.2

    all | < 19.2.5-r2

  • chainguard•gitlab-rails-ce-19.3

    < 19.3.1-r6

  • chainguard•gitlab-rails-ce-fips-18.1

    all

  • chainguard•gitlab-rails-ce-fips-18.10

    all

  • chainguard•gitlab-rails-ce-fips-18.11

    all

  • chainguard•gitlab-rails-ce-fips-18.6

    all

  • chainguard•gitlab-rails-ce-fips-18.7

    all

  • chainguard•gitlab-rails-ce-fips-18.8

    all

  • chainguard•gitlab-rails-ce-fips-18.9

    all

  • chainguard•gitlab-rails-ce-fips-19.0

    all

  • chainguard•gitlab-rails-ce-fips-19.1

    < 19.1.6-r5

  • chainguard•gitlab-rails-ce-fips-19.2

    all | < 19.2.5-r2

  • chainguard•gitlab-rails-ce-fips-19.3

    < 19.3.1-r3

  • chainguard•jupyter-base-notebook

    all

  • chainguard•keep-ui

    < 0.54.2-r1

  • chainguard•keep-ui-fips

    < 0.54.2-r2

  • chainguard•kibana-9.0

    < 9.0.8-r34

  • chainguard•kibana-9.0-bitnami

    < 9.0.8-r34

  • chainguard•kibana-9.0-iamguarded

    < 9.0.8-r34

  • chainguard•nextcloud-server-34

    < 34.0.2-r5

  • chainguard•opensearch-dashboards-2-dashboards-observability

    < 2.19.6-r8

  • chainguard•opensearch-dashboards-2-fips

    < 2.19.5-r18

  • chainguard•opensearch-dashboards-2-fips-alerting-dashboards-plugin

    < 2.19.5-r18

  • chainguard•opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin

    < 2.19.5-r18

  • chainguard•opensearch-dashboards-2-fips-dashboards-maps

    < 2.19.5-r18

  • chainguard•opensearch-dashboards-2-fips-dashboards-notifications

    < 2.19.5-r18

  • chainguard•opensearch-dashboards-2-fips-dashboards-observability

    < 2.19.5-r18

  • chainguard•opensearch-dashboards-2-fips-dashboards-query-workbench

    < 2.19.5-r18

  • chainguard•opensearch-dashboards-2-fips-dashboards-reporting

    < 2.19.5-r18

  • chainguard•opensearch-dashboards-2-fips-dashboards-search-relevance

    < 2.19.5-r18

  • chainguard•opensearch-dashboards-2-fips-dashboards-visualizations

    < 2.19.5-r18

Showing first 50 affected entries in server-rendered view.

References (56)