PT-2026-102752

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists in the soup uri decode data uri function, which incorrectly treats base64 data-URI payloads as NUL-terminated strings when calling g base64 decode inplace. If the percent-decode...

AlmaLinux 10 : cockpit-image-builder (ALSA-2026:71543)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:71543 advisory. fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri: fast-uri: Server-side request forgery vi...

Linux Distros Unpatched Vulnerability : CVE-2026-102555

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling...

PT-2026-108530

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

PT-2026-108463

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

PT-2026-108361

Security vulnerability affects the langfuse package. fast-uri serializes the port component of a URI without validating it...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-84292 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-84292 Source advisory: OSV:GHSA-QW65-CVWX-89V3...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-84292 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-84292 Source advisory: GHSA-QW65-CVWX-89V3...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +32 more potentially affected by CVE-2026-84292 via fast-uri (>=3.0.1, <=3.1.6)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.17.1, =5.4.3, =0.2.0-alpha.5, =0.1.0, =0.1.27 and more Source cves: CVE-2026-84292 Source advisory: OSV:GHSA-QW65-CVWX-89V3...

GHSA-QW65-CVWX-89V3 fast-uri vulnerable to authority injection via an unvalidated port in serialize

Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...

NPM: fast-uri vulnerable to authority injection via an unvalidated port in serialize

NPM: fast-uri vulnerable to authority injection via an unvalidated port in serialize vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.6...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +32 more potentially affected by CVE-2026-84292 via fast-uri (>=3.0.1, <=3.1.6)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.17.1, =5.4.3, =0.2.0-alpha.5, =0.1.0, =0.1.27 and more Source cves: CVE-2026-84292 Source advisory: GHSA-QW65-CVWX-89V3...

EUVD-2026-70280

fast-uri vulnerable to authority injection via an unvalidated port in serialize...

fast-uri vulnerable to authority injection via an unvalidated port in serialize

Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...

@leviyuan/lodestar (>=0.17.1, <=0.19.5), @openai/codex-security (>=0.1.26, <=0.1.27) +6 more potentially affected by CVE-2026-84394 via fast-uri (3.1.6)

fast-uri NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on fast-uri and may be impacted: - @leviyuan/lodestar =0.17.1, =0.1.26, =0.55.0-beta.11, =0.55.0-beta.11, =0.55.0-beta.11, =1.4.35, =0.1.13, =4.7.12, =4.7.14 Source cves:...

GHSA-58MR-GQGX-XQ4G fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

Impact fast-uri accepts a host that contains an unbalanced or misplaced authority bracket or without reporting an error. A host that starts with but does not end with , such as @127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the host wi...

EUVD-2026-70282

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority...

NPM: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

NPM: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.5...

@leviyuan/lodestar (>=0.17.1, <=0.19.5), @openai/codex-security (>=0.1.26, <=0.1.27) +6 more potentially affected by CVE-2026-84394 via fast-uri (3.1.6)

fast-uri NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on fast-uri and may be impacted: - @leviyuan/lodestar =0.17.1, =0.1.26, =0.55.0-beta.11, =0.55.0-beta.11, =0.55.0-beta.11, =1.4.35, =0.1.13, =4.7.12, =4.7.14 Source cves:...

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

Impact fast-uri accepts a host that contains an unbalanced or misplaced authority bracket or without reporting an error. A host that starts with but does not end with , such as @127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the host wi...