Is CVE-2026-6322 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6322 being exploited in the wild.

How severe is CVE-2026-6322?

High severity, with a CVSS score of 7.5, published 5 May 2026.

Which products and versions are affected?

fast-uri (npm) SEMVER:introduced=3.0.0,fixed=3.1.2; Red Hat Developer Hub 1.9.

Is there a fix for CVE-2026-6322?

Yes. fast-uri (npm): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6322 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6322?

Check whether you run fast-uri (npm), Openjsf Fast-Uri or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6322: Fastify fast-uri host confusion via percent-encoded authority delimiters

CVE-2026-6322 · Severity: high · CVSS 7.5 · Published 2026-05-05

A vulnerability in the fast-uri library, which is used for processing web addresses (URIs), can allow attackers to bypass security checks. By using specially formatted characters in a web link, an attacker can trick an application into connecting to a malicious website while appearing to connect to a trusted one. This could lead to unauthorized data redirection or the bypassing of security filters designed to restrict access to certain domains.

Technologies: fast-uri (npm), Red Hat Developer Hub. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-6322 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6322 being exploited in the wild.
How severe is CVE-2026-6322?: High severity, with a CVSS score of 7.5, published 5 May 2026.
Which products and versions are affected?: fast-uri (npm) SEMVER:introduced=3.0.0,fixed=3.1.2; Red Hat Developer Hub 1.9.
Is there a fix for CVE-2026-6322?: Yes. fast-uri (npm): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6322 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6322?: Check whether you run fast-uri (npm), Openjsf Fast-Uri or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-uri (npm): upgrade to 3.1.2 or later
```
npm install fast-uri@3.1.2
```

Technical details

The fast-uri library (v3.1.1 and earlier, and v2.4.0 and earlier) improperly handles percent-encoded authority delimiters such as %40 (@) and %3A (:) within the host component. During normalization, these characters are decoded and serialized back as raw characters, which fundamentally alters the URI's structure. For example, a URI like 'http://trusted.com%40evil.com/' is normalized to 'http://trusted.com@evil.com/', causing parsers to interpret 'evil.com' as the host and 'trusted.com' as user information. This interpretation conflict allows attackers to bypass allowlist checks or redirect validation. The issue is fixed in versions 3.1.2 and 2.4.1.

Affected products

fastify fast-uri >= 3.0.0, <= 3.1.1
fastify fast-uri <= 2.4.0

Identifiers

CVE-2026-6322
GHSA-v39h-62p7-jpjc

Timeline

2026-05-05: disclosed
2026-05-08: advisory
2026-05-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.