CVE-2026-6322
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.
| CWE | CWE-436 |
| Vendor | fast-uri |
| Product | fast-uri |
| Published | May 5, 2026 |
| Last Updated | May 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for fast-uri fast-uri
Be the first to know when new high vulnerabilities affecting fast-uri fast-uri are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
fast-uri / fast-uri
0 < 3.1.2
References
Credits
🔍 Jvr Matteo Collina Ulises Gascón KaKa