chore(deps): update dependency fast-uri to v4 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fast-uri	^3.1.5 → ^4.1.4
fast-uri	^3.1.2 → ^4.1.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

CVE-2026-75931 / GHSA-5jgf-p345-68v8

More information

Details

Impact

fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve() resolves a scheme-relative reference (//host/) against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved URI yields a different host than the one resolve() returned. An application that resolves an untrusted reference with fast-uri and then checks or routes on the resulting host can make a policy decision on one host and reach another. This is an incomplete-fix variant of CVE-2026-13676, whose IDN canonicalization was applied only to the scheme-bearing form.

Patches

Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. resolve() now canonicalizes the host once the effective scheme is known, and fails closed if a raw non-ASCII host cannot be converted.

Workarounds

Resolve scheme-relative references against a base that carries a scheme before performing any host-policy or origin check.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8
• https://nvd.nist.gov/vuln/detail/CVE-2026-75931
• https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5
• https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef
• https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/releases/tag/v2.4.5
• https://github.com/fastify/fast-uri/releases/tag/v3.1.6
• https://github.com/fastify/fast-uri/releases/tag/v4.1.3
• https://github.com/advisories/GHSA-5jgf-p345-68v8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

CVE-2026-75899 / GHSA-fph4-wmhf-6fwf

More information

Details

Impact

fast-uri decodes a hostname's percent escapes twice in a single normalize() or resolve() call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so normalize('http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/') returns http://localhost/. Applications that normalize or resolve an untrusted URI before an SSRF check, redirect validation, or host allowlist can be steered to a different destination, including internal addresses such as loopback or a cloud metadata endpoint, than the encoded input appeared to contain. This is an incomplete-fix variant of CVE-2026-6322, whose encoded-authority-delimiter fix introduced the second decode.

Patches

Fixed in fast-uri 2.4.5, 3.1.6, and 4.1.3.

Workarounds

Reject untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to normalize() or resolve().

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf
• https://nvd.nist.gov/vuln/detail/CVE-2026-75899
• https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f
• https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304
• https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/releases/tag/v2.4.5
• https://github.com/fastify/fast-uri/releases/tag/v3.1.6
• https://github.com/fastify/fast-uri/releases/tag/v4.1.3
• https://github.com/advisories/GHSA-fph4-wmhf-6fwf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

CVE-2026-75975 / GHSA-f65p-4m7j-42xc

More information

Details

Impact

fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize('http://[::not-valid]/private') returns http://[::]/private, and [fc00::not-hex] and [fe80::not-hex] collapse to [fc00::] and [fe80::]. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (::1), unique-local, or link-local. Because parse().error is unset for these inputs, checking it does not protect the consumer.

Patches

Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. Malformed IPv6 literals are now rejected with a host error instead of being normalized to a valid address.

Workarounds

Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri, or route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc
• https://nvd.nist.gov/vuln/detail/CVE-2026-75975
• https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595
• https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f
• https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/releases/tag/v2.4.5
• https://github.com/fastify/fast-uri/releases/tag/v3.1.6
• https://github.com/fastify/fast-uri/releases/tag/v4.1.3
• https://github.com/advisories/GHSA-f65p-4m7j-42xc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

CVE-2026-76172 / GHSA-jqff-g426-hqxp

More information

Details

Impact

fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape() and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore introduce structure the original input did not contain.

For example, %2f%2fevil.example:/pwn parses with no authority (parse().host is undefined), but resolve() and normalize() return //evil.example:/pwn, which reparses with host evil.example. The %uXXXX form (%u002f%u002fevil.example:/pwn) produces the same result, and a scheme containing %0d%0a reaches the output as a raw CR LF.

Applications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision, especially ones that treat a missing authority as same-origin, can be steered to an attacker-chosen authority, and a normalized URI placed in a response header can carry an injected CR LF.

Patches

Upgrade to fast-uri >= 4.1.3, or >= 3.1.6 in the v3.x release line, or >= 2.4.5 in the v2.x release line.

Workarounds

None. Upgrade to the patched version.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp
• https://nvd.nist.gov/vuln/detail/CVE-2026-76172
• https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862
• https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b
• https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/releases/tag/v2.4.5
• https://github.com/fastify/fast-uri/releases/tag/v3.1.6
• https://github.com/fastify/fast-uri/releases/tag/v4.1.3
• https://github.com/advisories/GHSA-jqff-g426-hqxp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fast-uri (fast-uri)

v4.1.4

Compare Source

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v4 release line should upgrade to v4.1.4.

Full Changelog: fastify/fast-uri@v4.1.3...v4.1.4

v4.1.3

Compare Source

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v4 release line should upgrade to v4.1.3.

Full Changelog: fastify/fast-uri@v4.1.2...v4.1.3

v4.1.2

Compare Source

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

What's Changed

• ci: pin actions to commit-hash by @​Fdawgs in #​189
• chore: bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​190
• docs: clarify security standards scope by @​mcollina in #​191
• ci: add ossf-scorecard workflow by @​Fdawgs in #​193
• ci(ossf-scorecard): add missing extension by @​Fdawgs in #​194

Full Changelog: fastify/fast-uri@v4.1.1...v4.1.2

v4.1.1

Compare Source

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v4.1.0...v4.1.1

v4.1.0

Compare Source

v4.0.1

Compare Source

⚠️ Security Release

• Fixes: GHSA-4c8g-83qw-93j6

What's Changed

• fix: normalize scheme to lowercase (RFC 3986 §6.2.2.1) by @​spokodev in #​182
• chore: update depedabot setting by @​climba03003 in #​179
• chore: replace http with https in urls by @​Fdawgs in #​184
• chore: bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​186

New Contributors

• @​spokodev made their first contribution in #​182
• @​climba03003 made their first contribution in #​179

Full Changelog: fastify/fast-uri@v4.0.0...v4.0.1

v4.0.0

Compare Source

What's Changed

• refactor(types): migrate from tsd to tstyche by @​Tony133 in #​172
• ci(ci): add node 26 to test matrices by @​Fdawgs in #​173
• chore: removed types deprecated by @​Tony133 in #​174
• fix: escape bug by @​zekth in #​181

Full Changelog: fastify/fast-uri@v3.1.2...v4.0.0

v3.1.7

Compare Source

v3.1.6

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Note

Overview
Pins fast-uri to v4.1.4 across the monorepo via pnpm overrides in package.json and pnpm-workspace.yaml, with the lockfile updated from 3.1.5 to 4.1.4.

This is a major-line security bump (v3 → v4) to address high-severity URI parsing issues (host confusion, SSRF via percent-decoding/IPv6 normalization, scheme normalization, and related advisories). fast-uri@4.1.4 is also added to minimumReleaseAgeExclude so Renovate can merge the security release without waiting on the 7-day minimum release age policy.

^{Reviewed by Cursor Bugbot for commit 692e26c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

<--- Last few GCs --->

[920:0x31924000]    48027 ms: Scavenge (reduce) (interleaved) 1496.4 (1515.6) -> 1496.4 (1514.8) MB, pooled: 0 MB, 19.80 / 0.00 ms  (average mu = 0.538, current mu = 0.440) allocation failure; 
[920:0x31924000]    48844 ms: Mark-Compact (reduce) 1497.4 (1514.8) -> 1497.3 (1515.6) MB, pooled: 0 MB, 488.66 / 0.00 ms  (+ 523.7 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1080 ms) (average mu = 0.415, cu

<--- JS stacktrace --->

FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xe40d24 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.0/bin/node]
 2: 0x1216be0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.0/bin/node]
 3: 0x1216eb7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.0/bin/node]
 4: 0x1444875  [/opt/containerbase/tools/node/22.22.0/bin/node]
 5: 0x145e109 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.0/bin/node]
 6: 0x14327b8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.0/bin/node]
 7: 0x14336e5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.0/bin/node]
 8: 0x140c015 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.0/bin/node]
 9: 0x1419228 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.0/bin/node]
10: 0x1571892 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.0/bin/node]
11: 0x1572fcf v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.0/bin/node]
12: 0x1576bf4  [/opt/containerbase/tools/node/22.22.0/bin/node]
13: 0x157927d v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.0/bin/node]
14: 0x1293f19 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.0/bin/node]
15: 0x1dcb3b6  [/opt/containerbase/tools/node/22.22.0/bin/node]
/usr/local/bin/node: line 18:   920 Aborted                 /opt/containerbase/tools/node/22.22.0/bin/node "$@"

[changeset-bot]

⚠️ No Changeset found

Latest commit: 692e26c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7bc9d72. Configure here.}