[AppSecAI Agent] fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

[conviso-platform-appsec-staging]

AppSecAI Agent

Issue ID: 1713785
Title: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Severity: HIGH
Type: ScaFinding

Description

Impact

fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize('http://[::not-valid]/private') returns http://[::]/private, and [fc00::not-hex] and [fe80::not-hex] collapse to [fc00::] and [fe80::]. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (::1), unique-local, or link-local. Because parse().error is unset for these inputs, checking it does not protect the consumer.

Patches

Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. Malformed IPv6 literals are now rejected with a host error instead of being normalized to a valid address.

Workarounds

Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri, or route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.

Fix Details

Security Fix: Upgrade fast-uri to resolve SSRF vulnerability

Summary

This PR fixes a HIGH severity security vulnerability in the fast-uri package by adding a resolution to enforce the use of a patched version.

Vulnerability Details

• Package: fast-uri
• Affected Version: 3.1.0
• Patched Version: 3.1.6
• Severity: HIGH
• Type: Server-Side Request Forgery (SSRF)

Description

fast-uri versions prior to 3.1.6 do not validate the complete RFC 3986 grammar for bracketed IPv6 literals. A malformed IPv6 literal with invalid trailing text is silently truncated to a different valid IPv6 address without reporting any error.

For example:

• normalize('http://[::not-valid]/private') returns http://[::]/private
• [fc00::not-hex] collapses to [fc00::]
• [fe80::not-hex] collapses to [fe80::]

This behavior can allow an attacker to craft a malformed URL that, after normalization, resolves to a local or private address (such as loopback ::1, unique-local, or link-local addresses). Since parse().error is not set for these malformed inputs, checking it does not protect consumers.

Fix

Added "fast-uri": "^3.1.6" to the resolutions field in package.json. This forces Yarn to use the patched version of fast-uri (3.1.6 or later) across all transitive dependencies, ensuring that malformed IPv6 literals are now properly rejected with a host error instead of being silently normalized to a valid address.

---

This PR was automatically created by Conviso Platform Auto-Fix.

[conviso-platform-appsec]

Conviso Security Gate — No Security Gate rule configured

No conviso_ast rule and no default rule are configured for this asset or company, so there is no policy to evaluate. Nothing was passed or failed.

No new findings were introduced by this pull request.

View the full run in Conviso