fast-uri
npm9 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting fast-uripage 1 of 1
- CVE-2026-13676HIGHCVSS 7.5EG 7.5✓ Fixed in 2.4.22026-06-29
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its o…
- CVE-2026-16221HIGHCVSS 7.5EG 7.5✓ Fixed in 4.1.12026-07-19
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fe…
- CVE-2026-18446HIGHCVSS 7.5EG 7.5✓ Fixed in 4.1.22026-07-31
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash …
- CVE-2026-6321HIGHCVSS 7.5EG 7.5✓ Fixed in 2.4.12026-05-04
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct UR…
- CVE-2026-6322HIGHCVSS 7.5EG 7.5✓ Fixed in 2.4.12026-05-05
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain…
- CVE-2026-75899HIGHCVSS 7.5EG 7.5✓ Fixed in 4.1.32026-08-24
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested perce…
- CVE-2026-75931HIGHCVSS 7.5EG 7.5✓ Fixed in 4.1.32026-08-24
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no…
- CVE-2026-75975HIGHCVSS 7.5EG 7.5✓ Fixed in 4.1.32026-08-24
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is…
- CVE-2026-76172HIGHCVSS 7.5EG 7.5✓ Fixed in 4.1.32026-08-24
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-esc…
Check whether fast-uri is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for fast-uri CVEs against the assets you own.
Start Free Scan →