CVE-2026-110725Low· 3.7▾ Sunlitfast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
0.3%
Disclosed via GHSA
0.3% → 0.3%
fast-uri's serialize(), normalize(), and resolve(), when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a path-noscheme reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. fast-uri's default serialization escapes that colon, but the suffix path does not.
For example, normalize('javascript:alert(1)', { reference: 'suffix' }) returns javascript:alert(1), which reparses as a live javascript: scheme; data: and vbscript: behave the same.
Applications that serialize or normalize a relative reference with reference: 'suffix' and then treat the result as a URI can turn inert input into a live javascript:, data:, or vbscript: URL (a cross-site scripting vector), and equal() can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default reference: 'suffix' option.
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.
Do not use the reference: 'suffix' option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.
fast-uri < 2.4.8fast-uri >= 3.0.0, < 3.1.9fast-uri >= 4.0.0, < 4.2.3Upgrade to a patched release:
fast-uri 2.4.8fast-uri 3.1.9fast-uri 4.2.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110095Low· 3.7fast-uri vulnerable to improper path equivalence in relative reference normalization
CVE-2026-110180Medium· 4.8fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110306Medium· 6.1fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
CVE-2026-84292High· 7.5fast-uri serializes the port component of a URI without validating it
CVE-2026-86818Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3
CVE-2026-86472Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv