CVE-2026-110725 | Low | 3.7 | 2026-10-20 | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2… |
CVE-2026-110306 | Medium | 6.1 | 2026-10-20 | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2… |
CVE-2026-110180 | Medium | 4.8 | 2026-10-20 | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 th… |
CVE-2026-110095 | Low | 3.7 | 2026-10-20 | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2… |
CVE-2026-86818 | Medium | 4.8 | 2026-09-15 | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 a… |
CVE-2026-86472 | Medium | 4.8 | 2026-09-15 | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 thro… |
CVE-2026-84394 | High | 7.5 | 2026-09-03 | fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but d… |
CVE-2026-84292 | High | 7.5 | 2026-09-02 | fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the por… |
CVE-2026-76172 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serializatio… |
CVE-2026-75975 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an… |
CVE-2026-75931 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference… |
CVE-2026-75899 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authori… |
CVE-2026-18446 | High | 7.5 | 2026-07-31 | fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introd… |
CVE-2026-16221 | High | 7.5 | 2026-07-19 | Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character… |
CVE-2026-13676 | High | 7.5 | 2026-06-29 | fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that… |
CVE-2026-6322 | High | 7.5 | 2026-05-05 | fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A… |
CVE-2026-6321 | High | 7.5 | 2026-05-04 | fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path da… |