Spotted what might be an issue in bun.lock around line 414.
fast-uri ≤ 3.1.2 (and 4.0.0) does not correctly canonicalize Unicode (IDN) hostnames for HTTP URLs. The library leaves the host in its original Unicode form, while Node's native URL parser normalizes it. An attacker can craft a URL with an IDN host that passes fast-uri‑based whitelist/deny‑list checks but is resolved to a different host by the actual request, bypassing host‑based security controls (e.g., redirect validation, proxy routing). This can lead to request forgery or exposure to malicious endpoints. The flaw is rated HIGH because it affects any application relying on fast-uri for security decisions. Upgrading to a fixed version (≥ 3.1.3) eliminates the mismatched parsing.
Something like this might fix it:
*** Begin Patch
*** Update File: bun.lock
@@
- name = "fast-uri"
- version = "3.1.0"
- resolved = "https://registry.bun.sh/fast-uri/3.1.0.tgz"
- integrity = "sha512-...oldhash..."
+ name = "fast-uri"
+ version = "3.1.3"
+ resolved = "https://registry.bun.sh/fast-uri/3.1.3.tgz"
+ integrity = "sha512-...newhash..."
*** End Patch
*** Begin Patch (optional, if a package.json is present)
*** Update File: package.json
@@
- "fast-uri": "3.1.0",
+ "fast-uri": "^3.1.3",
*** End Patch
*** End Patch
For reference: rule CVE-2026-13676. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
bun.lockaround line 414.fast-uri ≤ 3.1.2 (and 4.0.0) does not correctly canonicalize Unicode (IDN) hostnames for HTTP URLs. The library leaves the host in its original Unicode form, while Node's native URL parser normalizes it. An attacker can craft a URL with an IDN host that passes fast-uri‑based whitelist/deny‑list checks but is resolved to a different host by the actual request, bypassing host‑based security controls (e.g., redirect validation, proxy routing). This can lead to request forgery or exposure to malicious endpoints. The flaw is rated HIGH because it affects any application relying on fast-uri for security decisions. Upgrading to a fixed version (≥ 3.1.3) eliminates the mismatched parsing.
Something like this might fix it:
For reference: rule
CVE-2026-13676. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.