Description
fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape() and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore introduce structure the original input did not contain.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 4.1.3 >= 3.0.0, < 3.1.6 >= 2.3.1, < 2.4.5** Patched version(s): **4.1.3 3.1.6 2.4.5**
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to host confusion via percent-encoded scheme normalization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to host confusion via percent-encoded authority delimiters - CVE-2026-6322
- fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets - CVE-2026-86472
- fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - CVE-2026-75931
- fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding - CVE-2026-110306
You might also like:
See something that needs correcting? Let us knowUpdated September 02, 2026