Vulnerabilities

 1 via 1 paths

Dependencies

 114

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity
new

Interpretation Conflict

  • Vulnerable module: fast-uri
  • Introduced through: mercurius@16.9.0

Detailed paths

  • Introduced through: @aiswarm/api-graphql@aiswarm/api-graphql › mercurius@16.9.0 › graphql-jit@0.8.7 › fast-json-stringify@5.16.1 › fast-uri@2.4.0

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Interpretation Conflict during the decoding of URL host component. An attacker can manipulate the authority component of a URI by supplying percent-encoded delimiters, causing the host to be interpreted incorrectly during serialization. This can allow bypassing host allowlist checks, redirect validation, or outbound request routing by steering applications to an unintended authority.

Remediation

Upgrade fast-uri to version 3.1.2 or higher.

References

Interpretation Conflict vulnerability report