12134 matches found
CVE-2026-49830 DSpace: ORE resource URI does not validate scheme for non-web resources
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This...
CVE-2026-49830 DSpace: ORE resource URI does not validate scheme for non-web resources
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This...
GHSA-5JGF-P345-68V8 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Impact fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve resolves a scheme-relative reference //host/ against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved UR...
EUVD-2026-64758
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references...
NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.4.2, 2.4.5...
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Impact fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve resolves a scheme-relative reference //host/ against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved UR...
EUVD-2026-64772
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization...
NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.5...
@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +24 more potentially affected by CVE-2026-75975 via fast-uri (>=3.0.1, <=3.1.5)
fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-75975 Source advisory: OSV:GHSA-F65P-4M7J-42XC...
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Impact fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize'http://::not-valid/private' returns...
GHSA-F65P-4M7J-42XC fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Impact fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize'http://::not-valid/private' returns...
EUVD-2026-64763
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding...
GHSA-FPH4-WMHF-6FWF fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...
NPM: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
NPM: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.4.1, 2.4.5...
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...
@diviops/mcp-server (>=1.5.40, <=1.5.43), @donadiosolutions/lcm (>=1.4.2, <=1.4.3) +18 more potentially affected by CVE-2026-75899 via fast-uri (>=3.1.2, <=3.1.5)
fast-uri NPM version =3.1.2, =1.5.40, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =1.25.0, =0.1.5, =3.38.11, =3.39.0 and more Source cves: CVE-2026-75899 Source advisory: OSV:GHSA-FPH4-WMHF-6FWF...
NPM: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
NPM: fast-uri vulnerable to host confusion via percent-encoded scheme normalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.5...
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Impact fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore...
@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +24 more potentially affected by CVE-2026-76172 via fast-uri (>=3.0.1, <=3.1.5)
fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-76172 Source advisory: OSV:GHSA-JQFF-G426-HQXP...