# fast-uri (npm) vulnerabilities

17 known vulnerabilities (11 high, 4 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 211.6M
- Dependents: 5,698
- Registry: https://www.npmjs.com/package/fast-uri

## Advisories (17)

### [CVE-2026-110725](https://cve.now/CVE-2026-110725): fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

- Severity: Low 3.7
- Published: Oct 20, 2026
- Affected: fixed in 2.4.8; from 3.0.0, fixed in 3.1.9; from 4.0.0, fixed in 4.2.3.

### [CVE-2026-110306](https://cve.now/CVE-2026-110306): fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

- Severity: Medium 6.1
- Published: Oct 20, 2026
- Affected: fixed in 2.4.8; from 3.0.0, fixed in 3.1.9; from 4.0.0, fixed in 4.2.3.

### [CVE-2026-110180](https://cve.now/CVE-2026-110180): fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

- Severity: Medium 4.8
- Published: Oct 20, 2026
- Affected: from 2.4.2, fixed in 2.4.8; from 3.1.3, fixed in 3.1.9; from 4.0.1, fixed in 4.2.3.

### [CVE-2026-110095](https://cve.now/CVE-2026-110095): fast-uri vulnerable to improper path equivalence in relative reference normalization

- Severity: Low 3.7
- Published: Oct 20, 2026
- Affected: fixed in 2.4.8; from 3.0.0, fixed in 3.1.9; from 4.0.0, fixed in 4.2.3.

### [CVE-2026-86818](https://cve.now/CVE-2026-86818): fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

- Severity: Medium 4.8
- Published: Sep 15, 2026
- Affected: from 4.1.3, fixed in 4.1.5.

### [CVE-2026-86472](https://cve.now/CVE-2026-86472): fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

- Severity: Medium 4.8
- Published: Sep 15, 2026
- Affected: fixed in 2.4.7; from 3.0.0, fixed in 3.1.8; from 4.0.0, fixed in 4.1.5.

### [CVE-2026-84394](https://cve.now/CVE-2026-84394): fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

- Severity: High 7.5
- Published: Sep 2, 2026
- Affected: from 2.4.5, fixed in 2.4.6; from 3.1.6, fixed in 3.1.7; from 4.1.3, fixed in 4.1.4.

### [CVE-2026-84292](https://cve.now/CVE-2026-84292): fast-uri vulnerable to authority injection via an unvalidated port in serialize

- Severity: High 7.5
- Published: Sep 2, 2026
- Affected: fixed in 2.4.6; from 3.0.0, fixed in 3.1.7; from 4.0.0, fixed in 4.1.4.

### [CVE-2026-76172](https://cve.now/CVE-2026-76172): fast-uri vulnerable to host confusion via percent-encoded scheme normalization

- Severity: High 7.5
- Published: Aug 24, 2026
- Affected: from 2.3.1, fixed in 2.4.5; from 3.0.0, fixed in 3.1.6; from 4.0.0, fixed in 4.1.3.

### [CVE-2026-75975](https://cve.now/CVE-2026-75975): fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

- Severity: High 7.5
- Published: Aug 24, 2026
- Affected: from 2.3.1, fixed in 2.4.5; from 3.0.0, fixed in 3.1.6; from 4.0.0, fixed in 4.1.3.

### [CVE-2026-75899](https://cve.now/CVE-2026-75899): fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

- Severity: High 7.5
- Published: Aug 24, 2026
- Affected: from 2.4.1, fixed in 2.4.5; from 3.1.2, fixed in 3.1.6; from 4.0.0, fixed in 4.1.3.

### [CVE-2026-75931](https://cve.now/CVE-2026-75931): fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

- Severity: High 7.5
- Published: Aug 24, 2026
- Affected: from 2.4.2, fixed in 2.4.5; from 3.1.3, fixed in 3.1.6; from 4.0.1, fixed in 4.1.3.

### [CVE-2026-18446](https://cve.now/CVE-2026-18446): fast-uri vulnerable to host confusion via backslash authority introducer

- Severity: High 7.5
- Published: Jul 31, 2026
- Affected: fixed in 2.4.4; from 3.0.0, fixed in 3.1.5; from 4.0.0, fixed in 4.1.2.

### [CVE-2026-16221](https://cve.now/CVE-2026-16221): fast-uri vulnerable to host confusion via literal backslash authority delimiter

- Severity: High 7.5
- Published: Jul 19, 2026
- Affected: from 2.3.1, fixed in 2.4.3; from 3.0.0, fixed in 3.1.4; from 4.0.0, fixed in 4.1.1.

### [CVE-2026-13676](https://cve.now/CVE-2026-13676): fast-uri vulnerable to host confusion via failed IDN canonicalization

- Severity: High 7.5
- Published: Jun 29, 2026
- Affected: from 4.0.0, fixed in 4.0.1; from 3.0.0, fixed in 3.1.3; from 2.3.1, fixed in 2.4.2.

### [CVE-2026-6322](https://cve.now/CVE-2026-6322): fast-uri vulnerable to host confusion via percent-encoded authority delimiters

- Severity: High 7.5
- Published: May 5, 2026
- Affected: from 3.0.0, fixed in 3.1.2; fixed in 2.4.1.

### [CVE-2026-6321](https://cve.now/CVE-2026-6321): fast-uri vulnerable to path traversal via percent-encoded dot segments

- Severity: High 7.5
- Published: May 4, 2026
- Affected: from 3.0.0, fixed in 3.1.1; fixed in 2.4.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/fast-uri
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.