ADDRESSABLE · CVE-2026-126349 · Package
FIX → 2.9.1
Addressable's IDNA decoder accepts Punycode labels containing invisible or bidirectional control characters, so display_uri can show a hostname that differs from the one actually connected to. The flaw is a display spoof: connections still use the original encoded host.
first public Oct 30, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the Addressable gem from 2.0.0 through 2.9.1 and show hostnames produced by display_uri to people, such as in a link preview or a confirmation screen. Code that only uses host or normalized_host for network requests is not exposed to the display spoof. The native libidn backend is affected from 2.5.2.
Not affected if no-display-uri-use, not-on-2.0.0-to-2.9.0
Who cares addressable, rails, ruby
gem list addressable or bundle list.Gemfile.lock for the addressable line and its version.Addressable::URI#display_uri to show hostnames to users.Upgrade to 2.9.1
Addressable::IDNA.to_unicode decodes Punycode labels (labels beginning with xn--) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. Addressable::URI#display_uri uses to_unicode, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of http://xn--abcmoc-dm0c.com/ is displayed as abc, U+202E, moc.com, and the override makes everything after abc render right to left.
Parsing, host, normalized_host and any connection made from the URI are not affected. Only the displayed form is. Applications that show display_uri to users (link previews, chat and email clients, admin interfaces) can be used to make a malicious domain look like a trusted one.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
idn-ruby gem are installed, libidn rejects most of them, but not characters added to Unicode after version 3.2, such as U+061C and U+2066–U+2069.The pure-Ruby IDNA implementation is affected in Addressable >= 2.0.0. The native IDNA implementation is affected in Addressable >= 2.5.2, when to_unicode began accepting characters unassigned in Unicode 3.2. It is fixed in 2.9.1 for both implementations, where such labels are returned unchanged.
idn-ruby gem, so that Addressable uses the native IDNA implementation. This reduces the affected characters to those added since Unicode 3.2./[\p{Cc}\p{Cf}\p{Default_Ignorable_Code_Point}]/) and fall back to normalized_host when one is present.Reported by @andrewstellman.
If there are any questions or comments about this advisory:
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain · GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.