fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.
References
| Link | Resource |
|---|---|
| https://cna.openjsf.org/security-advisories.html | Vendor Advisory |
| https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc | Vendor Advisory |
Configurations
History
12 May 2026, 19:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:* | |
| First Time |
Openjsf fast-uri
Openjsf |
|
| References | () https://cna.openjsf.org/security-advisories.html - Vendor Advisory | |
| References | () https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc - Vendor Advisory |
05 May 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-05 11:16
Updated : 2026-05-12 19:11
NVD link : CVE-2026-6322
Mitre link : CVE-2026-6322
CVE.ORG link : CVE-2026-6322
JSON object : View
Products Affected
openjsf
- fast-uri
CWE
CWE-436
Interpretation Conflict