fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve pat
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
fast-uri is a popular Node.js URI parsing library that contains a critical inconsistency in how it handles internationalized domain names (IDNs). The vulnerability stems from selective ASCII canonicalization—the library only converts hosts to ASCII form when an explicit URI scheme is present, but leaves hosts verbatim when processing scheme-relative references (//host format). This creates a dangerous disagreement between the library's own functions: parse(), resolve(), normalize(), and equal() produce conflicting results for identical inputs depending solely on scheme presence. Organizations using fast-uri across microservices, API gateways, load balancers, or web frameworks are affected, as attackers can exploit these inconsistencies to bypass host validation, DNS rebinding protections, and same-origin policy checks. A malicious actor could craft URIs that pass validation in one context but resolve to different hosts in another, enabling request smuggling, cache poisoning, or unauthorized access to protected resources.
While Casky's current skill library shows 0 direct matches for this specific CVE, practitioners leveraging Claude AI with extended reasoning can detect the underlying attack patterns by monitoring for behavioral anomalies in URI processing logic. The techniques involved map to Defense Evasion and Application-Layer Attack patterns: attackers would attempt to bypass host validation rules by alternating between scheme-relative and absolute URI formats, causing inconsistent parsing across security boundaries. A practitioner using Casky would look for findings showing repeated mismatches in normalized domain outputs, divergent results from equal() comparisons on semantically identical URIs, or requests that pass initial validation but resolve to unexpected hosts during execution. Extended reasoning analysis can reveal the root cause—insufficient canonicalization logic—and recommend enforcing consistent ASCII normalization regardless of scheme presence, validating hosts after normalization rather than before, and implementing regression tests that verify parse/resolve/normalize/equal agreement across all URI formats.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-75931. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation