Description
fast-uri’s serialize(), normalize(), and resolve(), when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 4.2.3 >= 3.0.0, < 3.1.9 < 2.4.8** Patched version(s): **4.2.3 3.1.9 2.4.8**
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - CVE-2026-75931
- fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization - CVE-2026-86818
- fast-uri vulnerable to host confusion via percent-encoded scheme normalization - CVE-2026-76172
- fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding - CVE-2026-110306
You might also like:
See something that needs correcting? Let us knowUpdated October 23, 2026