CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

CVE-2026-110095

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

CVE-2026-110095

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

Red Hat: CVE-2026-110180: fast-uri: fast-uri: Security policy bypass via improper host canonicalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

Red Hat: CVE-2026-110306: fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

Linux Distros Unpatched Vulnerability : CVE-2026-110095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2,...

Linux Distros Unpatched Vulnerability : CVE-2026-110725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2,...

PT-2026-118255

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.8 fast-uri versions 3.0.0 through 3.1.8 fast-uri versions 4.0.0 through 4.2.2 Description When the serialize, normalize, or resolve functions are called with the non-default reference option set to suffix on a...

Red Hat: CVE-2026-110725: fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

Red Hat: CVE-2026-110095: fast-uri: fast-uri: Path traversal via improper relative URI normalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

Linux Distros Unpatched Vulnerability : CVE-2026-110306

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2,...

Linux Distros Unpatched Vulnerability : CVE-2026-110180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1...

PT-2026-118254

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.8 fast-uri versions 3.0.0 through 3.1.8 fast-uri versions 4.0.0 through 4.2.2 Description The software percent-decodes the scheme component using the legacy global unescape function before validation. This allows...

PT-2026-118248

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.8 fast-uri versions 3.0.0 through 3.1.8 fast-uri versions 4.0.0 through 4.2.2 Description The normalize and serialize functions incorrectly apply RFC 3986 dot-segment removal to the path of a relative-path...

PT-2026-118253

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.2 through 2.4.7 fast-uri versions 3.1.3 through 3.1.8 fast-uri versions 4.0.1 through 4.2.2 Description For HTTP-family schemes, the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its...

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656...

Fastify fast-uri input validation vulnerability

Versions of Fastify prior to 2.4.8, as well as versions 3.0.0 to 3.1.8 and 4.0.0 to 4.2.2, contain security vulnerabilities. These vulnerabilities stem from the use of the outdated global unescape function for percent decoding before verifying scheme components. This may result in dangerous schem...

Fastify fast-uri input validation vulnerability

The Fastify fast-uri versions from 2.4.2 to 2.4.7, 3.1.3 to 3.1.8, and 4.0.1 to 4.2.2 have security vulnerabilities. These vulnerabilities stem from the canonicalizeHost function, which does not check whether the WHATWG URL parser treats the entire input as a host for host name consumption. As a...

Fastify fast-uri: Vulnerability due to improper output processing

Versions of Fastify prior to 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2 contain security vulnerabilities. These vulnerabilities arise when the serialize, normalize, or resolve methods are used with a reference option set to a value other than the default suffix, and when the referenced...

Security Bulletin: Platform Navigator and Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in fast-uri

Summary Platform Navigator and Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in fast-uri. CVE-2026-84292, CVE-2026-84394 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-84292 DESCRIPTION: fast-uri serializes the port component of a U...