7.5

CVE-2026-13676: fast-uri vulnerable to host confusion via failed IDN canonicalization

Modified
AliasesUBUNTU-CVE-2026-13676DEBIAN-CVE-2026-13676CGA-2gg7-9qvx-hjfp
Published 29-06-2026Last modified 11-09-2026

Vulnerability summary

CVE-2026-13676 is a high (CVSS 7.5) Interpretation Conflict vulnerability in fast-uri. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.9% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.69%
0%100%
Low · +0.21 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
OPENSUSE-SU-2026:11680-1OPENSUSE-SU-2026:21448-1RHSA-2026:57590CGA-6Q79-H986-QCPV

Timeline

  1. 29-06-2026
    PublishedVulnerability first disclosed.
  2. 11-09-2026
    Last modifiedVulnerability information updated.

Description

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.69%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

Increase +0.21 pp

From 0.48% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard66 products
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.12< 3.12.9.4-r15
  • argo-workflows-ui-4.0< 4.0.11-r0
  • commercial-gitlab-rails-ee-19.1< 19.1.7-r3
Wolfi7 products
  • argo-workflows-ui-4.0< 4.0.11-r0
  • jupyter-base-notebook< 7.6.3-r2
  • opensearch-dashboards-3< 3.7.0-r9
  • prism< 5.16.0-r4
  • vitess-24< 24.0.2-r7
Opensuse2 products
  • python-pydata-sphinx-theme&distro=openSUSE Leap 16.0< 0.16.1-bp160.3.1
  • python-pydata-sphinx-theme&distro=openSUSE Tumbleweed< 0.19.0-2.1
Debian1 product
  • node-ajvAll versions (No fix recorded) | < 8.20.0~ds+~cs7.1.2-1
Fast-uri1 product
  • fast-uri≥ 4.0.0, < 4.0.1 | ≥ 2.3.1, < 3.1.3
Npm1 product
  • fast-uri≥ 4.0.0, < 4.0.1 | ≥ 3.0.0, < 3.1.3 | ≥ 2.3.1, < 2.4.2
Openjsf1 product
  • fast-uri≥ 2.3.1, < 3.1.3 | ≥ 4.0.0, < 4.0.1
Ubuntu1 product
  • node-ajvAll versions (No fix recorded)

8 vendors · 80 products

References

60 links
Show all 60 references