In-app reader
fast-uri versions >= 2.3.1, For example, http://127。0。0。1/is treated byfast-urias host127。0。0。1, while Node's WHATWG URL parser and fetch()canonicalize the same input to127.0.0.1`.
Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination.
Upgrade to fast-uri v4.0.1, v3.1.3, or v2.4.2
None. Upgrade to the patched version.
Discussion
Sign in to join the discussion.
Keep reading
Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.