URI Parser Vulnerability in fast-uri for Node.js

CVE-2026-110725

What is CVE-2026-110725?

The fast-uri library, a dependency-free URI parser for Node.js, suffers from a vulnerability that allows improper handling of relative references. This issue occurs when methods such as serialize(), normalize(), or resolve() are invoked with a non-default 'suffix' option on references lacking authority. Consequently, a bare colon can appear in the first path segment, leading to invalid URI structures. Malicious actors might exploit this flaw by converting inert inputs into executable JavaScript, data, or VBScript URLs, thereby creating a cross-site scripting (XSS) vector. Applications utilizing the suffix option with unchecked input are particularly at risk. It is crucial for users to upgrade to fixed versions (2.4.8, 3.1.9, or 4.2.3 or later) or to avoid using the suffix option on untrusted inputs as an immediate precaution.

References