fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00254.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
fast-uri fast-uri unaffected
Version Status Constraints
0 affected < 2.4.8
2.4.8 unaffected —
3.0.0 affected < 3.1.9
3.1.9 unaffected —
4.0.0 affected < 4.2.3
4.2.3 unaffected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Fast-uri Subscribe
Fast-uri Subscribe

Project Subscriptions

Vendors Products
Fast-uri Subscribe
Fast-uri Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://cna.openjsf.org/security-advisories.html cve-icon cve-icon cve-icon
https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-110725 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-110725 cve-icon
History

Tue, 20 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Fast-uri
Fast-uri fast-uri
Vendors & Products Fast-uri
Fast-uri fast-uri

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.
Title fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
Weaknesses CWE-116
CWE-41
CWE-79
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

threat_severity

Low

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: openjs

Published:

Updated: 2026-10-20T07:06:29.946Z

Reserved: 2026-10-14T14:53:33.214Z

Link: CVE-2026-110725

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T07:17:08.937

Modified: 2026-10-20T07:17:08.937

Link: CVE-2026-110725

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-20T07:06:29Z

Links: CVE-2026-110725 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T16:15:14Z

Weaknesses