{"action":"Upgrade fast-uri to 2.4.2 or later.","affected":[{"fixed":"4.0.1","introduced":"4.0.0"},{"fixed":"3.1.3","introduced":"3.0.0"},{"fixed":"2.4.2","introduced":"2.3.1"}],"component":"fast-uri","cve_ids":["CVE-2026-13676"],"ecosystem":"npm","epss":0.00692,"exploited":false,"fixed_versions":["4.0.1","3.1.3","2.4.2"],"ghsa_id":"GHSA-4c8g-83qw-93j6","id":"tcs_01M5KF03F1BKS7E1QVXGBR8EF4","modified_at":"2026-09-11T15:45:36.494239136Z","published_at":"2026-07-21T19:03:11Z","references":["https://osv.dev/vulnerability/GHSA-4c8g-83qw-93j6","https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","https://nvd.nist.gov/vuln/detail/CVE-2026-13676","https://github.com/fastify/fast-uri/pull/188","https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05","https://github.com/fastify/fast-uri/commit/21ea1f9d70495c931f55dff893a8fa38f4f2e6bd","https://github.com/fastify/fast-uri/commit/01db48010f594b98f7b323be18b393791c66ed1d","https://access.redhat.com/errata/RHSA-2026:63371","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-13676","https://bugzilla.redhat.com/show_bug.cgi?id=2494197","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri","https://github.com/fastify/fast-uri/releases/tag/v2.4.2","https://github.com/fastify/fast-uri/releases/tag/v3.1.3","https://github.com/fastify/fast-uri/releases/tag/v4.0.1","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:42815","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:44239","https://access.redhat.com/errata/RHSA-2026:44268","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48126","https://access.redhat.com/errata/RHSA-2026:49642","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:51196","https://access.redhat.com/errata/RHSA-2026:51197","https://access.redhat.com/errata/RHSA-2026:51342","https://access.redhat.com/errata/RHSA-2026:51348","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:54760"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-4c8g-83qw-93j6","url":"https://osv.dev/vulnerability/GHSA-4c8g-83qw-93j6"}],"summary":"fast-uri vulnerable to host confusion via failed IDN canonicalization"}