CVE-2026-110306Medium· 6.1▾ Sunlitfast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
0.2%
Disclosed via GHSA
0.2% → 0.3%
fast-uri percent-decodes the scheme component with the legacy global unescape() before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but fast-uri does.
For example, normalize('%6Aavascript:alert(1)') returns javascript:alert(1), resolve('https://a.example/', '%6Aavascript:alert(1)') returns javascript:alert(1), and parse('%6Aavascript:alert(1)').scheme returns javascript. The %uXXXX form (%u006Aavascript:) produces the same result, and equal('%68ttp://a/', 'http://a/') returns true.
An application that screens dangerous schemes on the raw input and then stores or renders normalize(input) or resolve(base, input) turns an inert string into an executable javascript:, data:, or vbscript: URL, a stored or reflected cross-site scripting vector in the consuming application. equal() also treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists.
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.
Reject input whose scheme part (before the first :, and before any /, ?, or #) contains %. Alternatively, check parse(x).scheme against an allowlist after normalization and use that same parsed result rather than the raw string.
fast-uri < 2.4.8fast-uri >= 3.0.0, < 3.1.9fast-uri >= 4.0.0, < 4.2.3Upgrade to a patched release:
fast-uri 2.4.8fast-uri 3.1.9fast-uri 4.2.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110180Medium· 4.8fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110095Low· 3.7fast-uri vulnerable to improper path equivalence in relative reference normalization
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-86818Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3
CVE-2026-86472Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv
CVE-2026-84292High· 7.5fast-uri serializes the port component of a URI without validating it