PT-2026-91923

Name of the Vulnerable Software and Affected Versions fast-uri versions 4.1.3 through 4.1.4 Description The mailto parser compares query field names to reserved names such as to, subject, and body while they are still percent-encoded. Because the parser only decodes these names when storing them ...

PT-2026-91922

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.7 fast-uri versions 3.0.0 through 3.1.7 fast-uri versions 4.0.0 through 4.1.4 Description The software folds the host to lowercase before percent-decoding it. Consequently, a percent-encoded uppercase octet, such...

CVE-2026-86472: Improper Handling of Case Sensitivity

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

Linux Distros Unpatched Vulnerability : CVE-2026-86472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 throu...

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode Internationalized Domain Name - IDN hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when...

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode Internationalized Domain Name - IDN hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when...

Security Bulletin: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules fast-uri, postcss, axios, jsonata and body-parser...

Security Bulletin: IBM ApplinX is vulnerable to multiple issues like double decoding, interpretation conflict and more due to the use of fast-uri (CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172)

Summary IBM ApplinX is vulnerable to multiple issues like double decoding, interpretation conflict and more due to the use of fast-uri CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172. The fast-uri version has been updated within IBM ApplinX in order to address the mentioned...

Security Bulletin: IBM ApplinX is vulnerable to being directed to unintended host due to the use of fast-uri (CVE-2026-18446)

Summary IBM ApplinX is vulnerable to being directed to unintended host due to the use of fast-uri CVE-2026-18446. The fast-uri version has been updated within IBM ApplinX in order to address the vulnerability. Vulnerability Details CVEID:CVE-2026-18446 DESCRIPTION: fast-uri before 4.1.2, 3.1.5, a...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

SUSE CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

SUSE CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 10.3.23 of Jira Software Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticat...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Service Management Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 10.3.23 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an...