Cross-Site Scripting Vulnerability in fast-uri URI Parser for Node.js
CVE-2026-110306

6.1MEDIUM

Key Information:

Vendor

Fast-uri

Status
Fast-uri
Vendor
CVE Published:
20 October 2026

What is CVE-2026-110306?

The fast-uri library for Node.js, in specific versions, contains a vulnerability where it improperly handles percent-encoded scheme components. By utilizing the legacy global unescape() function for decoding, it allows malicious input to be emitted as active scripts. This can transform harmless strings into executable JavaScript or similar dangerous commands, posing a significant risk of reflected or stored cross-site scripting. Developers are advised to upgrade to fast-uri versions 2.4.8, 3.1.9, or 4.2.3 to mitigate this issue. As an interim solution, inputs containing a percent sign in the scheme should be rejected, or the normalized scheme should be validated against a strict allowlist.

Affected Version(s)

fast-uri 0 < 2.4.8

fast-uri 3.0.0 < 3.1.9

fast-uri 4.0.0 < 4.2.3

References

https://github.com/fastify/fast-uri/security/advisories/G...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

UlisesGascon
mcollina
zekth
.