CVE-2026-49830 DSpace: ORE resource URI does not validate scheme for non-web resources

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This...

@diviops/mcp-server (>=1.5.40, <=1.5.43), @diviskit/mcp-server (>=1.6.0, <=1.7.0) +19 more potentially affected by CVE-2026-75931 via fast-uri (>=3.1.3, <=3.1.5)

fast-uri NPM version =3.1.3, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =0.1.5, =0.1.6 and more Source cves: CVE-2026-75931 Source advisory: OSV:GHSA-5JGF-P345-68V8...

@diviops/mcp-server (>=1.5.40, <=1.5.43), @diviskit/mcp-server (>=1.6.0, <=1.7.0) +19 more potentially affected by CVE-2026-75931 via fast-uri (>=3.1.3, <=3.1.5)

fast-uri NPM version =3.1.3, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =0.1.5, =0.1.6 and more Source cves: CVE-2026-75931 Source advisory: GHSA-5JGF-P345-68V8...

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

Impact fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve resolves a scheme-relative reference //host/ against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved UR...

NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.4.2, 2.4.5...

EUVD-2026-64758

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references...

GHSA-5JGF-P345-68V8 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

Impact fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve resolves a scheme-relative reference //host/ against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved UR...

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

Impact fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize'http://::not-valid/private' returns...

GHSA-F65P-4M7J-42XC fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

Impact fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize'http://::not-valid/private' returns...

NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.5...

EUVD-2026-64772

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +26 more potentially affected by CVE-2026-75975 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.3 and more Source cves: CVE-2026-75975 Source advisory: GHSA-F65P-4M7J-42XC...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +26 more potentially affected by CVE-2026-75975 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.3 and more Source cves: CVE-2026-75975 Source advisory: OSV:GHSA-F65P-4M7J-42XC...

@diviops/mcp-server (>=1.5.40, <=1.5.43), @diviskit/mcp-server (>=1.6.0, <=1.7.0) +20 more potentially affected by CVE-2026-75899 via fast-uri (>=3.1.2, <=3.1.5)

fast-uri NPM version =3.1.2, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =1.25.0, =1.28.5 and more Source cves: CVE-2026-75899 Source advisory: OSV:GHSA-FPH4-WMHF-6FWF...

EUVD-2026-64763

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding...

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...

GHSA-FPH4-WMHF-6FWF fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...

NPM: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

NPM: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.4.1, 2.4.5...

@diviops/mcp-server (>=1.5.40, <=1.5.43), @diviskit/mcp-server (>=1.6.0, <=1.7.0) +20 more potentially affected by CVE-2026-75899 via fast-uri (>=3.1.2, <=3.1.5)

fast-uri NPM version =3.1.2, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =1.25.0, =1.28.5 and more Source cves: CVE-2026-75899 Source advisory: GHSA-FPH4-WMHF-6FWF...

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

Impact fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore...