VULNERABILITY INTELLIGENCE

CVE-2026-13676

CVSS score7.5 HIGH

EPSS probability0.69%

CISA KEVNot currently listed

Published2026-06-29

Last modified2026-09-11

Description

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still retu…