CVE-2026-110725

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

CVE-2026-110725

The fast-uri Node.js URI parser and serializer is vulnerable to scheme injection in versions before 2.4.8 , 3.1.9 , and 4.2.3 . When the serialize(), normalize(), or resolve() functions are called with the non-default suffix option on a reference lacking authority, the library fails to escape a b...