CVE-2026-13676 — fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to...
CVE-2026-13676 漏洞深度分析
漏洞概述
CVE 编号： CVE-2026-13676
CVSS 评分： 7.5（HIGH）
CVSS 向量： CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE 分类： CWE-436,CWE-551
漏洞状态： Modified
发布时间： 2026-06-29T14:16:47.967
最后更新： 2026-07-14T12:16:55.547
漏洞描述
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.
影响分析
此漏洞的具体影响取决于实际利用场景。"
修复建议
- 及时关注厂商发布的安全更新和补丁
- 升级受影响组件到最新版本
- 如无法立即升级，参考厂商提供的临时缓解措施
- 加强网络访问控制和监控