CVE-2026-6322

CVE-2026-6322 affects the fast-uri package. The vuln lies in normalize(): it decodes percent-encoded authority delimiters inside the host and then re-emits them as raw delimiters during serialization. This can cause a host, which combines an allowed domain, an encoded at-sign, and a different dom...

CVE-2026-13676

The CVE concerns the fast-uri library (versions 2.3.1–3.1.2 and 4.0.0) where the IDN host canonicalization path fails to normalize Unicode hosts for HTTP URLs. A helper used in IDN conversion does not exist on the global URL constructor, leaving the host in Unicode form while normalize() and equa...

CVE-2026-6321

Affected software: fast-uri. Vulnerability: percent-encoded path separators and dot segments are decoded before dot‑segment removal in normalize() and equal() so encoded data is treated like real slashes and parent directories, allowing distinct URIs to normalize to the same path. Impact: applica...