Improper Handling of Case Sensitivity

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to inconsistent normalization in the host component. An attacker can gain unauthorized access to restricted resources or services by submitting...

Linux Distros Unpatched Vulnerability : CVE-2026-86818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 an...

Linux Distros Unpatched Vulnerability : CVE-2026-86472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 throu...

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode Internationalized Domain Name - IDN hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when...

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode Internationalized Domain Name - IDN hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when...

ROOT-APP-NPM-CVE-2026-18446 CVE-2026-18446 in fast-uri - Patched by Root

Root has patched CVE-2026-18446 in the fast-uri package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-16221 CVE-2026-16221 in fast-uri - Patched by Root

Root has patched CVE-2026-16221 in the fast-uri package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-13676 CVE-2026-13676 in fast-uri - Patched by Root

Root has patched CVE-2026-13676 in the fast-uri package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-6321 CVE-2026-6321 in fast-uri - Patched by Root

Root has patched CVE-2026-6321 in the fast-uri package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-6322 CVE-2026-6322 in fast-uri - Patched by Root

Root has patched CVE-2026-6322 in the fast-uri package for Root:npm. Multiple fixed versions available...

Security Bulletin: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native...

fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules fast-uri, postcss, axios, jsonata and body-parser...

Security Bulletin: IBM ApplinX is vulnerable to being directed to unintended host due to the use of fast-uri (CVE-2026-18446)

Summary IBM ApplinX is vulnerable to being directed to unintended host due to the use of fast-uri CVE-2026-18446. The fast-uri version has been updated within IBM ApplinX in order to address the vulnerability. Vulnerability Details CVEID:CVE-2026-18446 DESCRIPTION: fast-uri before 4.1.2, 3.1.5, a...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 10.3.23 of Jira Software Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticat...