- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 17 · 11 high, 4 medium, 2 low
- Weekly downloads
- 211.6M
- Dependents
- 5,698
- Registry
- npm
Advisories 17
- CVE-2026-110725Low 3.7
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
Affected: fixed in 2.4.8; from 3.0.0, fixed in 3.1.9; from 4.0.0, fixed in 4.2.3.
- CVE-2026-110306Medium 6.1
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
Affected: fixed in 2.4.8; from 3.0.0, fixed in 3.1.9; from 4.0.0, fixed in 4.2.3.
- CVE-2026-110180Medium 4.8
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
Affected: from 2.4.2, fixed in 2.4.8; from 3.1.3, fixed in 3.1.9; from 4.0.1, fixed in 4.2.3.
- CVE-2026-110095Low 3.7
fast-uri vulnerable to improper path equivalence in relative reference normalization
Affected: fixed in 2.4.8; from 3.0.0, fixed in 3.1.9; from 4.0.0, fixed in 4.2.3.
- CVE-2026-86818Medium 4.8
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Affected: from 4.1.3, fixed in 4.1.5.
- CVE-2026-86472Medium 4.8
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
Affected: fixed in 2.4.7; from 3.0.0, fixed in 3.1.8; from 4.0.0, fixed in 4.1.5.
- CVE-2026-84394High 7.5
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
Affected: from 2.4.5, fixed in 2.4.6; from 3.1.6, fixed in 3.1.7; from 4.1.3, fixed in 4.1.4.
- CVE-2026-84292High 7.5
fast-uri vulnerable to authority injection via an unvalidated port in serialize
Affected: fixed in 2.4.6; from 3.0.0, fixed in 3.1.7; from 4.0.0, fixed in 4.1.4.
- CVE-2026-76172High 7.5
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Affected: from 2.3.1, fixed in 2.4.5; from 3.0.0, fixed in 3.1.6; from 4.0.0, fixed in 4.1.3.
- CVE-2026-75975High 7.5
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Affected: from 2.3.1, fixed in 2.4.5; from 3.0.0, fixed in 3.1.6; from 4.0.0, fixed in 4.1.3.
- CVE-2026-75899High 7.5
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Affected: from 2.4.1, fixed in 2.4.5; from 3.1.2, fixed in 3.1.6; from 4.0.0, fixed in 4.1.3.
- CVE-2026-75931High 7.5
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Affected: from 2.4.2, fixed in 2.4.5; from 3.1.3, fixed in 3.1.6; from 4.0.1, fixed in 4.1.3.
- CVE-2026-18446High 7.5
fast-uri vulnerable to host confusion via backslash authority introducer
Affected: fixed in 2.4.4; from 3.0.0, fixed in 3.1.5; from 4.0.0, fixed in 4.1.2.
- CVE-2026-16221High 7.5
fast-uri vulnerable to host confusion via literal backslash authority delimiter
Affected: from 2.3.1, fixed in 2.4.3; from 3.0.0, fixed in 3.1.4; from 4.0.0, fixed in 4.1.1.
- CVE-2026-13676High 7.5
fast-uri vulnerable to host confusion via failed IDN canonicalization
Affected: from 4.0.0, fixed in 4.0.1; from 3.0.0, fixed in 3.1.3; from 2.3.1, fixed in 2.4.2.
Show all 17 advisoriesShow fewer advisories
- CVE-2026-6322High 7.5
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Affected: from 3.0.0, fixed in 3.1.2; fixed in 2.4.1.
- CVE-2026-6321High 7.5
fast-uri vulnerable to path traversal via percent-encoded dot segments
Affected: from 3.0.0, fixed in 3.1.1; fixed in 2.4.1.