{"id":"GHSA-333x-w4r6-6crp","revision":null,"records":[{"revision":"ba66ba360a7c4fe9aa02eeef1496683e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110725","aliases":[],"title":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","state":0,"publishedAt":"2026-10-20T07:06:29.946+00:00","modifiedAt":"2026-10-20T19:14:41.685+00:00","affected":[{"ecosystem":"Vendor product","name":"fast-uri","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"fast-uri\",\n                    \"product\": \"fast-uri\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.4.8\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"2.4.8\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.0.0\",\n                            \"lessThan\": \"3.1.9\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"3.1.9\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"4.2.3\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"4.2.3\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/fast-uri\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":"LOW"}],"references":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110725","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110725","identifiers":["CVE-2026-110725"]},"retained":false,"historicalAffected":[]},{"revision":"82ffab6e10064892851178e0acd56161","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-110725","aliases":[],"title":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default opti…","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","state":0,"publishedAt":"2026-10-20T07:17:08.937+00:00","modifiedAt":"2026-10-20T20:17:16.123+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":"LOW"}],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-41","CWE-116"],"productCriteria":[],"sourceDates":{"published":"2026-10-20T07:17:08.937","lastModified":"2026-10-20T20:17:16.123"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-110725","identifiers":["CVE-2026-110725"]},"retained":false,"historicalAffected":[]},{"revision":"d288a8cbc2e24e94ac28b425a39ac71e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-333x-w4r6-6crp","aliases":["CVE-2026-110725"],"title":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","description":"### Impact\n\n`fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a `path-noscheme` reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. `fast-uri`'s default serialization escapes that colon, but the suffix path does not.\n\nFor example, `normalize('javascript:alert(1)', { reference: 'suffix' })` returns `javascript:alert(1)`, which reparses as a live `javascript:` scheme; `data:` and `vbscript:` behave the same.\n\nApplications that serialize or normalize a relative reference with `reference: 'suffix'` and then treat the result as a URI can turn inert input into a live `javascript:`, `data:`, or `vbscript:` URL (a cross-site scripting vector), and `equal()` can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default `reference: 'suffix'` option.\n\n### Patches\n\nUpgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.\n\n### Workarounds\n\nDo not use the `reference: 'suffix'` option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.","state":0,"publishedAt":"2026-10-23T21:36:40+00:00","modifiedAt":"2026-10-23T21:45:04.9003114+00:00","affected":[{"ecosystem":"npm","name":"fast-uri","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.4.8"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fast-uri","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.1.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fast-uri","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.2.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"sourceUrl":"https://github.com/advisories/GHSA-333x-w4r6-6crp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-333x-w4r6-6crp","identifiers":["GHSA-333x-w4r6-6crp","CVE-2026-110725"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T14:35:48.1677058+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T14:35:48.1677058+00:00","lastSuccessAt":"2026-10-26T14:35:48.3516958+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:48.3516975+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-c9e0dc0e630c65d3e2eec6bfd23be086a2f833dd3e7570a16b44670030aaf25b","complete":true,"records":414172,"lastAttemptAt":"2026-10-26T14:35:43.3458888+00:00","lastSuccessAt":"2026-10-26T14:35:43.2997194+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.3458888+00:00","snapshotPublishedAt":"2026-10-26T13:53:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T14:36:16.7068084+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4064,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T14:35:48.1677058+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T14:35:48.1677058+00:00","lastSuccessAt":"2026-10-26T14:35:48.3524508+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:48.3524813+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ddf1516e1d944b74b0e29872646a7464","complete":true,"records":13416,"lastAttemptAt":"2026-10-26T14:36:14.7824466+00:00","lastSuccessAt":"2026-10-26T14:36:14.779+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:36:14.779+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T14:35:43.7672517+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.7672517+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T14:35:43.5489133+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.5489133+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-26T14:35:48.1177056+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:48.1177056+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-690135177074a0c4b9ddcb48232cb870c32b1a7adcd972a81c224810b8437d0d","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T14:35:43.6565309+00:00","lastSuccessAt":"2026-10-26T12:37:54.7648812+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.6565309+00:00","snapshotPublishedAt":"2026-10-26T11:48:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}