[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fast-uri	3.1.7 → 3.1.9

---

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

CVE-2026-86472 / GHSA-hrr3-gc8f-f4qj

More information

Details

Impact

fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference (//host) there is no scheme, so the host canonicalization that repairs this on a scheme-bearing URL does not run. As a result parse, normalize, and equal disagree on the same host: parse("//%41.com").host returns "A.com" while parse("//a.com").host and parse("//A.com").host return "a.com", and equal("//%41.com", "//a.com") is false even though equal("//A.com", "//a.com") is true. An application that makes a case-sensitive host decision on fast-uri output for a scheme-relative reference, for example a host allowlist or denylist that compares parse(url).host or uses fast-uri.equal, can be steered past the check with a percent-encoded uppercase octet. Because a hostname is case-insensitive in DNS and HTTP routing, the evading spelling reaches the same host the check meant to gate, so the effect is check evasion rather than reaching a different registrable host.

Patches

Upgrade to fast-uri 4.1.5, 3.1.8, or 2.4.7.

Workarounds

Compare hosts case-insensitively (lowercase the parsed host before any allowlist or denylist decision), or avoid making case-sensitive host decisions on scheme-relative input until upgrading.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj
• https://nvd.nist.gov/vuln/detail/CVE-2026-86472
• https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.7
• https://github.com/fastify/fast-uri/releases/tag/v3.1.8
• https://github.com/fastify/fast-uri/releases/tag/v4.1.5

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

CVE-2026-110725 / GHSA-333x-w4r6-6crp

More information

Details

Impact

fast-uri's serialize(), normalize(), and resolve(), when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a path-noscheme reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. fast-uri's default serialization escapes that colon, but the suffix path does not.

For example, normalize('javascript:alert(1)', { reference: 'suffix' }) returns javascript:alert(1), which reparses as a live javascript: scheme; data: and vbscript: behave the same.

Applications that serialize or normalize a relative reference with reference: 'suffix' and then treat the result as a URI can turn inert input into a live javascript:, data:, or vbscript: URL (a cross-site scripting vector), and equal() can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default reference: 'suffix' option.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Do not use the reference: 'suffix' option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp
• https://nvd.nist.gov/vuln/detail/CVE-2026-110725
• https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e
• https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.8
• https://github.com/fastify/fast-uri/releases/tag/v3.1.9
• https://github.com/fastify/fast-uri/releases/tag/v4.2.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

CVE-2026-110306 / GHSA-w74x-v6f9-j3xg

More information

Details

Impact

fast-uri percent-decodes the scheme component with the legacy global unescape() before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but fast-uri does.

For example, normalize('%6Aavascript:alert(1)') returns javascript:alert(1), resolve('https://a.example/', '%6Aavascript:alert(1)') returns javascript:alert(1), and parse('%6Aavascript:alert(1)').scheme returns javascript. The %uXXXX form (%u006Aavascript:) produces the same result, and equal('%68ttp://a/', 'http://a/') returns true.

An application that screens dangerous schemes on the raw input and then stores or renders normalize(input) or resolve(base, input) turns an inert string into an executable javascript:, data:, or vbscript: URL, a stored or reflected cross-site scripting vector in the consuming application. equal() also treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Reject input whose scheme part (before the first :, and before any /, ?, or #) contains %. Alternatively, check parse(x).scheme against an allowlist after normalization and use that same parsed result rather than the raw string.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg
• https://nvd.nist.gov/vuln/detail/CVE-2026-110306
• https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4
• https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3
• https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.8
• https://github.com/fastify/fast-uri/releases/tag/v3.1.9
• https://github.com/fastify/fast-uri/releases/tag/v4.2.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

CVE-2026-110180 / GHSA-wjr9-j795-jxcr

More information

Details

Impact

fast-uri versions >= 2.4.2, <= 2.4.7, >= 3.1.3, <= 3.1.8, and >= 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser with no error set: data before an @ is dropped and whitespace is removed.

For example, fast-uri parses http://a@b@evil.example/ to host evil.example (dropping the b segment), and a host containing a raw TAB, CR, or LF has those characters stripped. equal() then treats a whitespace-smuggled host as the same as the clean one, and resolve() rewrites the authority the same way.

Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host fast-uri returns differs from what was checked, and traffic can be steered to an unintended destination.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Reject URIs whose authority contains more than one @, or contains TAB, CR, or LF, before calling fast-uri. Alternatively, treat any non-empty parse(x).error as fatal, and compare hosts only from the same parse() result.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr
• https://nvd.nist.gov/vuln/detail/CVE-2026-110180
• https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a
• https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c
• https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.8
• https://github.com/fastify/fast-uri/releases/tag/v3.1.9
• https://github.com/fastify/fast-uri/releases/tag/v4.2.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to improper path equivalence in relative reference normalization

CVE-2026-110095 / GHSA-xhq7-xmqj-769h

More information

Details

Impact

fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one.

For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)) points at a different resource than resolve(base, ref), and equal() treats distinct references as the same.

Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h
• https://nvd.nist.gov/vuln/detail/CVE-2026-110095
• https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47
• https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9
• https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058
• https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd
• https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a
• https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.8
• https://github.com/fastify/fast-uri/releases/tag/v3.1.9
• https://github.com/fastify/fast-uri/releases/tag/v4.2.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fast-uri (fast-uri)

v3.1.9

Compare Source

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: enable trusted publishing releases (v3.x) by @​mcollina in #​229

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

v3.1.8

Compare Source

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

• GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!