15 matches found
Security Bulletin: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter
Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native...
Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-13676)
Summary There are vulnerabilities in fast-uri-3.1.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-13676. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicod...
EUVD-2026-64763
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding...
Security Bulletin: Vulnerability in fast-ur affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in fast-ur has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabili...
Linux Distros Unpatched Vulnerability : CVE-2026-75899
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authorit...
CVE-2026-75899
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...
CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...
CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...
CVE-2026-75899
fast-uri , a URI parser for Node.js, suffers from double percent-decoding of the hostname: it decodes percent escapes during parsing and decodes them again during authority recomposition. This violates RFC 3986 §2.4 (an implementation must not decode the same string more than once) and allows a s...
PT-2026-80191
Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.1 through 2.4.4 fast-uri versions 3.1.2 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2 Description This URI parser for Node.js decodes percent escapes in a hostname during parsing and subsequently decodes the parsed...
Linux Distros Unpatched Vulnerability : CVE-2026-16221
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character...
SUSE CVE-2026-13676
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize and equal still return...
CVE-2026-13676
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize and equal still return...
CVE-2026-13676 fast-uri vulnerable to host confusion via failed IDN canonicalization
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize and equal still return...
