CVE-2026-86472

A flaw was found in fast-uri, a dependency-free URI parser. This vulnerability occurs because the software folds the host to lowercase before percent-decoding it, allowing percent-encoded uppercase characters to bypass this normalization. A remote attacker could exploit this by crafting a malicious URI with a percent-encoded uppercase octet, potentially bypassing host allowlists or denylists in applications that rely on fast-uri's output for case-sensitive host decisions. This could lead to a security bypass, allowing access to restricted resources or services.

Moderate: A security bypass flaw was found in fast-uri due to inconsistent host case normalization. This issue allows an attacker to bypass host allowlist or denylist security checks in applications that perform case-sensitive host comparisons on fast-uri output, potentially leading to unauthorized access or actions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications utilizing fast-uri for host validation should implement case-insensitive comparisons by converting the parsed host to lowercase before performing any allowlist or denylist checks. This ensures that variations in host casing, including percent-encoded uppercase octets, do not lead to security bypasses.