CVE-2026-110095

A flaw was found in fast-uri. The library improperly applies dot-segment removal to relative Uniform Resource Identifier URI paths during normalization, causing leading parent-directory segments to be discarded. A remote attacker could supply a crafted relative path to an application that relies ...

DEBIAN-CVE-2026-110095

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

CVE-2026-110095

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110180

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

CVE-2026-110725

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

CVE-2026-110725 fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

CVE-2026-110725 fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

CVE-2026-110725

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

CVE-2026-110725

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

CVE-2026-110725

The fast-uri Node.js URI parser and serializer is vulnerable to scheme injection in versions before 2.4.8 , 3.1.9 , and 4.2.3 . When the serialize(), normalize(), or resolve() functions are called with the non-default suffix option on a reference lacking authority, the library fails to escape a b...

CVE-2026-110306 fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306 fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306 fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306

The fast-uri Node.js URI parser and serializer is vulnerable to URI scheme spoofing in versions before 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2. The root cause is that the library uses the legacy global unescape() function to percent-decode the scheme component before validation. This ...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

CVE-2026-110180

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...