fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| fast-uri | fast-uri | unaffected |
|
No data.
| Vendor | Product | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Fast-uri | Fast-uri |
|
| Source | ID | Title |
|---|---|---|
Github GHSA |
GHSA-v39h-62p7-jpjc | fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.512% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openjsf
Openjsf fast-uri |
|
| CPEs | cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:* | |
| Vendors & Products |
Openjsf
Openjsf fast-uri |
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Fast-uri
Fast-uri fast-uri |
|
| Vendors & Products |
Fast-uri
Fast-uri fast-uri |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later. | |
| Title | fast-uri vulnerable to host confusion via percent-encoded authority delimiters | |
| Weaknesses | CWE-436 | |
| References |
| |
| Metrics |
cvssV3_1
|
No data.
OpenCVE enrichment
Updated: Aug 14, 2026, 4:30 AM
Github GHSA