Is CVE-2026-110306 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110306 being exploited in the wild.

How severe is CVE-2026-110306?

Medium severity, with a CVSS score of 6.1, published 20 October 2026.

Which products and versions are affected?

Fastify Fast-Uri before 2.4.8, 3.0.0 through 3.1.8, 4.0.0 through 4.2.2; fast-uri (npm) < 2.4.8, SEMVER:introduced=0,fixed=2.4.8.

How is CVE-2026-110306 attacked?

It is attacked over the network.

Am I affected by CVE-2026-110306?

Check whether you run Fastify Fast-Uri or fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110306: fast-uri URI scheme spoofing via percent-encoded scheme

Q: Is there a fix for CVE-2026-110306?

Yes. fast-uri (npm): upgrade to 2.4.8 or later. Until then: Reject input whose scheme part (before the first colon, and before any slash, question mark, or hash) contains a percent sign. Alternatively, validate the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw input string. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-110306 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-110306?

Check whether you run Fastify Fast-Uri or fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110306 · Severity: medium · CVSS 6.1 · Published 2026-10-20

fast-uri is a Node.js library that parses and normalizes web addresses (URIs) according to web standards. A vulnerability allows attackers to disguise dangerous URI schemes like "javascript:" or "data:" by encoding them with percent signs, which fast-uri decodes before validating. Applications that check the original input for dangerous schemes but then use the normalized result from fast-uri can inadvertently execute malicious code, enabling stored or reflected cross-site scripting attacks.

Technologies: fast-uri (npm). Vendors: Fastify, npm.

Quick answers

Is CVE-2026-110306 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110306 being exploited in the wild.
How severe is CVE-2026-110306?: Medium severity, with a CVSS score of 6.1, published 20 October 2026.
Which products and versions are affected?: Fastify Fast-Uri before 2.4.8, 3.0.0 through 3.1.8, 4.0.0 through 4.2.2; fast-uri (npm) < 2.4.8, SEMVER:introduced=0,fixed=2.4.8.
Is there a fix for CVE-2026-110306?: Yes. fast-uri (npm): upgrade to 2.4.8 or later. Until then: Reject input whose scheme part (before the first colon, and before any slash, question mark, or hash) contains a percent sign. Alternatively, validate the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw input string. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110306 attacked?: It is attacked over the network.
Am I affected by CVE-2026-110306?: Check whether you run Fastify Fast-Uri or fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-uri (npm): upgrade to 2.4.8 or later
```
npm install fast-uri@2.4.8
```

Reject input whose scheme part (before the first colon, and before any slash, question mark, or hash) contains a percent sign. Alternatively, validate the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw input string.

Technical details

The vulnerability stems from fast-uri percent-decoding the URI scheme component using the legacy unescape() function before validating it, violating RFC 3986 which prohibits percent-encoding in schemes. An attacker can supply input like "%6Aavascript:alert(1)" which decodes to "javascript:alert(1)", bypassing scheme validation and allowlist comparisons. The vulnerability affects multiple functions (normalize, resolve, parse, equal) and has user interaction as a precondition (the application must process untrusted input).

Affected products

Fastify fast-uri before 2.4.8, 3.0.0 through 3.1.8, 4.0.0 through 4.2.2

Identifiers

CVE-2026-110306
GHSA-w74x-v6f9-j3xg

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.