fast-uri: fast-uri: URI authority bypass due to improper delimiter handling

🗓️ 09 Jul 2026 14:49:43Reported by RedHatType

redhat🔗 access.redhat.com👁 33 Views

fast-uri authority bypass via percent-encoded delimiters; normalization emits raw separators.

Reporter	Title	Published	Views	Family All 351
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-6322)	21 Sep 202607:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in axios, follow-redirects, fast-uri and babel might affect IBM Storage Defender Sentinel Anomaly Scan Engine.	27 Jun 202615:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	16 Jun 202616:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Endpoint Management is affected by multiple vulnerabilities.	22 Jul 202613:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	22 Jul 202617:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Software	13 Aug 202606:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs	1 Jun 202609:22	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-6322)	30 Jul 202615:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules fast-uri and protobufjs (CVE-2026-6322, CVE-2026-45740 & CVE-2026-6321)	16 Jun 202610:55	–	ibm
attackerkb	CVE-2026-6322	5 May 202610:29	–	attackerkb

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	10.2	x86_64	rh-podman-desktop	1.1.1-1.el10_2	rh-podman-desktop-1.1.1-1.el10_2.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-6322
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-6322
cve	www.cve.org/CVERecord

30 Sep 2026 16:58Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.17.5

EPSS0.00675

SSVC

fast uri authority bypass percent encoded delimiter handling uri normalization host allowlist redirect validation outbound routing security controls