Description
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑site scripting via scheme injection
Action: Patch Now
AI Analysis

Impact

fast-uri’s serialize, normalize, or resolve functions can emit a relative reference that contains an unescaped colon in its first path segment when the reference option is set to suffix. That colon is interpreted as a scheme by the URI parser, turning benign user input into a live javascript:, data:, or vbscript: URL. When the resulting string is treated as a URI, it can execute client‑side code or trigger a cross‑site scripting attack.

Affected Systems

The flaw affects fast‑uri versions earlier than 2.4.8; in the 3.x series before 3.1.9; and in the 4.x series before 4.2.3. Any Node.js application that imports fast‑uri and calls serialize, normalize, or resolve with the suffix reference option on untrusted data is vulnerable.

Risk and Exploitability

The CVSS score of 3.7 indicates moderate risk, but the EPSS is below 1% and the flaw is not listed in the CISA KEV catalog, pointing to a low probability of current exploitation. Nevertheless, the vulnerability can create executable URLs, making it attractive to attackers who control web content or application input. The attack surface is limited to code that uses the non‑default suffix reference option, so remediation can be targeted.

Generated by OpenCVE AI on October 20, 2026 at 15:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade fast‑uri to 2.4.8, 3.1.9, 4.2.3, or a later release.
  • If an upgrade is not feasible, stop using the suffix reference option on any untrusted data.
  • If the suffix option must be used, percent‑encode any colon that appears in the first path segment before the string is treated as a URI.
  • After applying the fix or workaround, audit the code that serializes or normalizes URIs to confirm no unsafe relative references remain.

Generated by OpenCVE AI on October 20, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Fast-uri
Fast-uri fast-uri
Vendors & Products Fast-uri
Fast-uri fast-uri

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.
Title fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
Weaknesses CWE-116
CWE-41
CWE-79
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

threat_severity

Low

Subscriptions

Fast-uri Fast-uri
cve-icon MITRE

Status: PUBLISHED

Assigner: openjs

Published:

Updated: 2026-10-20T07:06:29.946Z

Reserved: 2026-10-14T14:53:33.214Z

Link: CVE-2026-110725

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T07:17:08.937

Modified: 2026-10-20T07:17:08.937

Link: CVE-2026-110725

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-20T07:06:29Z

Links: CVE-2026-110725 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T16:15:14Z

Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output

  • CWE-41

    Improper Resolution of Path Equivalence

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')