fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
CVE-2026-110306
Impact fast-uri percent-decodes the scheme component with the legacy global unescape() before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but fast-uri does. For example, normalize('%6Aavascript:alert(1)') returns javascript:alert(1), resolve('https://a.example/', '%6Aavascript:alert(1)') returns javascript:alert(1), and parse('%6Aavascript:alert(1)').scheme returns javascript. The %uXXXX form (%u006Aavascript:) produces the same result, and equal('%68ttp://a/', 'http://a/') returns true. An application that screens dangerous schemes on the raw input and then stores or renders normalize(input) or resolve(base, input) turns an inert string into an executable javascript:, data:, or vbscript: URL, a stored or reflected cross-site scripting vector in the consuming application. equal() also treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. Patches Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3. Workarounds Reject input whose scheme part (before the…
Assessment
- CVSS
- 6.1 (v3.1)
- Severity
- Medium
- EPSS
- 0.0025% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 23 October 2026
- Last updated
- 23 October 2026
- Affected
- npm · fast-uri
- Weakness
- CWE-172, CWE-180
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
At the source
References
- https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg
- https://nvd.nist.gov/vuln/detail/CVE-2026-110306
- https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4
- https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3
- https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fast-uri/releases/tag/v2.4.8
- https://github.com/fastify/fast-uri/releases/tag/v3.1.9
- https://github.com/fastify/fast-uri/releases/tag/v4.2.3
- https://github.com/advisories/GHSA-w74x-v6f9-j3xg
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-110306