[ Vendor · 8 CVEs ]
fast-uri
CVEs affecting fast-uri published in the last 30 days, plus any fast-uri CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110095 | 20 Oct 2026 | CVSS 3.7 | fast-urifast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0… | |
| CVE-2026-110180 | 20 Oct 2026 | CVSS 4.8 | fast-urifast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and… | |
| CVE-2026-110306 | 20 Oct 2026 | CVSS 6.1 | fast-urifast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0… | |
| CVE-2026-110725 | 20 Oct 2026 | CVSS 3.7 | fast-urifast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0… | |
| CVE-2026-86818 | 15 Sep 2026 | CVSS 4.8 | fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronizationfast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In… | Fix |
| CVE-2026-86472 | 15 Sep 2026 | CVSS 4.8 | fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsfast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from… | Fix |
| CVE-2026-84394 | 2 Sep 2026 | CVSS 7.5 | fast-uri vulnerable to host confusion via an unclosed bracket in the URI authorityfast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening… | Fix |
| CVE-2026-84292 | 2 Sep 2026 | CVSS 7.5 | fast-uri vulnerable to authority injection via an unvalidated port in serializefast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped… | Fix |