fast-uri <=3.1.2/4.0.0 Unicode IDN Canonicalization Bug
CVE-2026-13676 Published on June 29, 2026

fast-uri vulnerable to host confusion via failed IDN canonicalization
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

NVD

Vulnerability Analysis

CVE-2026-13676 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Types

Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection. For instance, the character strings /./ and / both mean current directory. If /SomeDirectory is a protected directory and an attacker requests /./SomeDirectory, the attacker may be able to gain access to the resource if /./ is not converted to / before the authorization check is performed.

Products Associated with CVE-2026-13676

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Confidential Compute Attestation

Red Hat Cryostat

Red Hat Migration Toolkit Applications

Red Hat Rhmt

Red Hat Multicluster Engine

Red Hat Network Observ Optr

Red Hat Openshift Lightspeed

Red Hat Openshift Pipelines

Red Hat Serverless

Red Hat Acm

Red Hat Amq Broker

Red Hat Ansible Automation Platform

Red Hat Apache Camel Hawtio

Red Hat Apicurio Registry

Red Hat Podman Desktop

Red Hat Connectivity Link

Red Hat Jboss Data Grid

Red Hat Rhdh

Red Hat Discovery

Red Hat Edge Manager

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux Ai

Red Hat Openshift Ai

Red Hat Openshift

Red Hat Openshift Data Foundation

Red Hat Openshift Devspaces

Red Hat Container Native Virtualization

Red Hat Quay

Red Hat Satellite

Red Hat Ansible Portal

Affected Versions

fast-uri:

Version 4.0.0 and below 4.0.1 is affected.
Version 4.0.1 is unaffected.
Version 2.3.1 and below 3.1.3 is affected.
Version 3.1.3 is unaffected.

Red Hat Enterprise Linux 10:

Version 0:1.1.2-1.el10_2 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.11:

Version 1786911977 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.17:

Version 1786668856 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1786908361 and below * is unaffected.

Red Hat Ansible Automation Platform 2.2:

Version 1784622951 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1785773509 and below * is unaffected.

Red Hat Ansible Automation Platform 2.7:

Version 1785413994 and below * is unaffected.

Red Hat Developer Hub 1.10:

Version 1785332487 and below * is unaffected.

Red Hat Developer Hub 1.10:

Version 1785340831 and below * is unaffected.

Red Hat Developer Hub 1.10:

Version 1785332825 and below * is unaffected.

Red Hat Developer Hub 1.10:

Version 1785332668 and below * is unaffected.

Red Hat Developer Hub 1.10:

Version 1785332694 and below * is unaffected.

Red Hat Developer Hub 1.10:

Version 1785411652 and below * is unaffected.

Red Hat Developer Hub 1.9:

Version 1784210921 and below * is unaffected.

Red Hat Discovery 2:

Version 1786634825 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194938 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194574 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784126822 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784127736 and below * is unaffected.

Red Hat Migration Toolkit 1.8:

Version 1783690532 and below * is unaffected.

Red Hat Migration Toolkit for Applications 8.2:

Version 1784109883 and below * is unaffected.

Red Hat OpenShift Container Platform 4.16:

Version 1785530656 and below * is unaffected.

Red Hat OpenShift Container Platform 4.17:

Version 1784744859 and below * is unaffected.

Red Hat OpenShift Container Platform 4.19:

Version 1784144829 and below * is unaffected.

Red Hat OpenShift Container Platform 4.20:

Version 1783596795 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 1783510956 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 1784728481 and below * is unaffected.

Red Hat OpenShift Container Platform 4.22:

Version 1783559447 and below * is unaffected.

Red Hat OpenShift Container Platform 4.22:

Version 1784729919 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705347 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706101 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705558 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705646 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706138 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705741 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705777 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705802 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705938 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706577 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706125 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706177 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706188 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706679 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706357 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706612 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706644 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706659 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706880 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786701839 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786701555 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702052 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702559 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702713 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702264 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702448 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702276 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702440 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702315 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786703071 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702563 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702636 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702623 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786703137 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702716 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702872 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702949 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702917 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786703143 and below * is unaffected.