CVE-2026-13676
HIGH 7.5fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.
Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 29th percentile
Impact if exploited
7.5CVSS 3.1 · HIGH
- ConfidentialityNone
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
- github-search Search GitHub for public PoC repos
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-13676/poc.jsonMachine-readable PoC index for this CVE (for automation).Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-13676/poc.json
Affected
Vendors Fast Uri Red Hat Openjsf
Products Fast Uri Red Hat Developer Hub 1.9 Red Hat Edge Manager 1.1 Red Hat Migration Toolkit 1.8 Red Hat Openshift Container Platform 4.20 Red Hat Openshift Container Platform 4.21 Red Hat Openshift Container Platform 4.22 Red Hat Quay 3.16 Red Hat Quay 3.9 Confidential Compute Attestation Cryostat 4 Migration Toolkit For Applications 8
Weakness (CWE)
- CWE-436: : Interpretation Conflict
- CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Openjsf | Fast Uri | ≥ 2.3.1 and < 3.1.3 |
| Openjsf | Fast Uri | ≥ 4.0.0 and < 4.0.1 |
All CVSS metrics
- HIGH 7.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - HIGH 7.5 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
Patches & mitigations
Advisories
- https://cna.openjsf.org/security-advisories.html
- https://access.redhat.com/security/cve/CVE-2026-13676
- https://bugzilla.redhat.com/show_bug.cgi?id=2494197
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json
- https://access.redhat.com/errata/RHSA-2026:41929
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:37628
- https://access.redhat.com/errata/RHSA-2026:37186
- https://access.redhat.com/errata/RHSA-2026:37585
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:40262