p PatchFirst

CVE-2026-6322

CVE-2026-6322 · fast-uri vulnerable to host confusion via percent-encoded authority delimiters

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • fast-uri

    Versions
    • ≥ 0, < 3.1.2: Affected (semver)
    • 3.1.2: Not affected (semver)

    Update to 3.1.2

  • node-ajv Debian:12

    Versions
    • 6.12.6-3
    • 8.11.2~ds+~2.1.1-1
    • 8.12.0~ds+~2.1.1-1
    • 8.12.0~ds+~2.1.1-2
    • 8.12.0~ds+~2.1.1-3
    • 8.12.0~ds+~2.1.1-4
    • 8.12.0~ds+~2.1.1-5
    • 8.17.1~ds+~3.0.1+~3.1.0-1
    • 8.17.1~ds+~3.0.1+~3.1.0-2
    • 8.17.1~ds+~3.0.1+~3.1.0-3
    • 8.17.1~ds+~3.0.1+~3.1.0-4
    • 8.18.0~ds+~cs6.1.1-1
    • 8.18.0~ds+~cs6.1.1-2
    • 8.20.0~ds+~cs6.1.3-1
    • 8.20.0~ds+~cs7.1.2-1
    • 8.20.0~ds+~cs7.1.3-1
    • 8.20.0~ds+~cs7.1.3-2
    • 8.20.0~ds+~cs7.1.3-3
    • 8.20.0~ds+~cs7.1.4-1
    • 8.20.0~ds+~cs7.1.5-1
    • 8.20.0~ds+~cs7.1.6-1
    • 8.8.2~ds+~2.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ajv Debian:13

    Versions
    • 8.12.0~ds+~2.1.1-5
    • 8.17.1~ds+~3.0.1+~3.1.0-1
    • 8.17.1~ds+~3.0.1+~3.1.0-2
    • 8.17.1~ds+~3.0.1+~3.1.0-3
    • 8.17.1~ds+~3.0.1+~3.1.0-4
    • 8.18.0~ds+~cs6.1.1-1
    • 8.18.0~ds+~cs6.1.1-2
    • 8.20.0~ds+~cs6.1.3-1
    • 8.20.0~ds+~cs7.1.2-1
    • 8.20.0~ds+~cs7.1.3-1
    • 8.20.0~ds+~cs7.1.3-2
    • 8.20.0~ds+~cs7.1.3-3
    • 8.20.0~ds+~cs7.1.4-1
    • 8.20.0~ds+~cs7.1.5-1
    • 8.20.0~ds+~cs7.1.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ajv Debian:14

    Versions
    • 8.12.0~ds+~2.1.1-5
    • 8.17.1~ds+~3.0.1+~3.1.0-1
    • 8.17.1~ds+~3.0.1+~3.1.0-2
    • 8.17.1~ds+~3.0.1+~3.1.0-3
    • 8.17.1~ds+~3.0.1+~3.1.0-4
    • 8.18.0~ds+~cs6.1.1-1
    • 8.18.0~ds+~cs6.1.1-2
    Affected ranges
    • ECOSYSTEM: < 8.20.0~ds+~cs6.1.3-1

    Update to 8.20.0~ds+~cs6.1.3-1

  • fast-uri npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.1.2

    Update to 3.1.2

  • fast-uri npm

    Affected ranges
    • SEMVER: < 2.4.1

    Update to 2.4.1

  • node-ajv Ubuntu:18.04:LTS

    Versions
    • 5.0.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ajv Ubuntu:20.04:LTS

    Versions
    • 6.10.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ajv Ubuntu:22.04:LTS

    Versions
    • 6.12.6-2
    • 6.12.6-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ajv Ubuntu:24.04:LTS

    Versions
    • 6.12.6-3
    • 8.12.0~ds+~2.1.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ajv Ubuntu:25.10

    Versions
    • 8.12.0~ds+~2.1.1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ajv Ubuntu:26.10

    Versions
    • 8.17.1~ds+~3.0.1+~3.1.0-4build1
    • 8.20.0~ds+~cs6.1.3-1
    • 8.20.0~ds+~cs7.1.2-1
    • 8.20.0~ds+~cs7.1.3-1
    • 8.20.0~ds+~cs7.1.3-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ajv Ubuntu:26.04:LTS

    Versions
    • 8.12.0~ds+~2.1.1-5
    • 8.17.1~ds+~3.0.1+~3.1.0-2
    • 8.17.1~ds+~3.0.1+~3.1.0-4build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →