Log in Start free

Vulnerability · Published May 5, 2026 · Assigned by openjs

CVE-2026-6322fast-uri vulnerable to host confusion via percent-encoded authority delimiters

High 7.5

In plain English

A high-severity security flaw in fast-uri from fast-uri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 56.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-ajvno fix listedDEBIAN-CVE-2026-6322
Debian:13node-ajvno fix listedDEBIAN-CVE-2026-6322
Debian:14node-ajv8.20.0~ds+~cs6.1.3-1DEBIAN-CVE-2026-6322
Ubuntu:22.04:LTSnode-ajvno fix listedUBUNTU-CVE-2026-6322
Ubuntu:24.04:LTSnode-ajvno fix listedUBUNTU-CVE-2026-6322
Ubuntu:25.10node-ajvno fix listedUBUNTU-CVE-2026-6322
Ubuntu:26.04:LTSnode-ajvno fix listedUBUNTU-CVE-2026-6322
Ubuntu:26.10node-ajvno fix listedUBUNTU-CVE-2026-6322
npmfast-uri3.1.2GHSA-v39h-62p7-jpjc
npmfast-uri2.4.1GHSA-v39h-62p7-jpjc

Affected products (as reported)

VendorProductVersions
fast-uri fast-uri 0 – before 3.1.2

Weakness: CWE-436, CWE-140 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References