GHSA-WJR9-J795-JXCR fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Impact fast-uri versions = 2.4.2, = 3.1.3, = 4.0.1, = 4.2.2 can silently rewrite the host of an HTTP-family URL http, https, ws, wss, or any scheme with domainHost: true. For those schemes canonicalizeHost passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking...

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Impact fast-uri versions = 2.4.2, = 3.1.3, = 4.0.1, = 4.2.2 can silently rewrite the host of an HTTP-family URL http, https, ws, wss, or any scheme with domainHost: true. For those schemes canonicalizeHost passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking...

Atlassian Confluence 9.1.x < 9.2.24 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104501)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104501 advisory. - fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP- family URLs. The IDN conversion path calls a...

SUSE CVE-2026-110180

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

Linux Distros Unpatched Vulnerability : CVE-2026-110180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1...

Fastify fast-uri input validation vulnerability

The Fastify fast-uri versions from 2.4.2 to 2.4.7, 3.1.3 to 3.1.8, and 4.0.1 to 4.2.2 have security vulnerabilities. These vulnerabilities stem from the canonicalizeHost function, which does not check whether the WHATWG URL parser treats the entire input as a host for host name consumption. As a...

Security Bulletin: Vulnerabilities reported in fast-uri-3.1.3.tgz are addressed in APIM 11.1

Summary Vulnerabilities reported in fast-uri-3.1.3.tgz are addressed in APIM 11.1 Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character...

Security Bulletin: Vulnerability in fast-uri bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the fast-uri library, which is affected by an improper input validation vulnerability. CVE-2026-13676, CVE-2026-16221, CVE-2026-18446 Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-13676)

Summary A domain label parsing boundary vulnerability in the fast-uri URI parsing library CVE-2026-13676 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1...

Injection fast-uri Dependency in Jira Service Management Data Center

This High severity Injection vulnerability was introduced in versions 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2026-18446: Interpretation Conflict

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-16221: Interpretation Conflict

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CVE-2026-13676

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize and equal still return...

CVE-2026-13676: Interpretation Conflict

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize and equal still return...

CVE-2026-30964

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...