# CVE-2026-6322: Fastify fast-uri host confusion via percent-encoded authority delimiters

Source: https://junglewise.ai/threats/cve-2026-6322-fastify-fast-uri-host-confusion-via-percent-encoded-authority  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-08-10  
License: CC BY 4.0 with a link back

CVE-2026-6322 · Severity: high · CVSS 7.5 · Published 2026-05-05

A vulnerability in the fast-uri library, which is used for processing web addresses (URIs), can allow attackers to bypass security checks. By using specially formatted characters in a web link, an attacker can trick an application into connecting to a malicious website while appearing to connect to a trusted one. This could lead to unauthorized data redirection or the bypassing of security filters designed to restrict access to certain domains.

Technologies: [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri), [Red Hat Developer Hub](https://junglewise.ai/threats/technologies/developer-hub). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-6322 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6322 being exploited in the wild.

**How severe is CVE-2026-6322?** High severity, with a CVSS score of 7.5, published 5 May 2026.

**Which products and versions are affected?** fast-uri (npm) SEMVER:introduced=3.0.0,fixed=3.1.2; Red Hat Developer Hub 1.9.

**Is there a fix for CVE-2026-6322?** Yes. fast-uri (npm): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6322 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6322?** Check whether you run fast-uri (npm), Openjsf Fast-Uri or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-uri (npm): upgrade to 3.1.2 or later

  ```sh
  npm install fast-uri@3.1.2
  ```


## Technical details

The fast-uri library (v3.1.1 and earlier, and v2.4.0 and earlier) improperly handles percent-encoded authority delimiters such as %40 (@) and %3A (:) within the host component. During normalization, these characters are decoded and serialized back as raw characters, which fundamentally alters the URI's structure. For example, a URI like 'http://trusted.com%40evil.com/' is normalized to 'http://trusted.com@evil.com/', causing parsers to interpret 'evil.com' as the host and 'trusted.com' as user information. This interpretation conflict allows attackers to bypass allowlist checks or redirect validation. The issue is fixed in versions 3.1.2 and 2.4.1.

## Affected products

- fastify fast-uri >= 3.0.0, <= 3.1.1
- fastify fast-uri <= 2.4.0

## Identifiers

- CVE-2026-6322
- GHSA-v39h-62p7-jpjc

## Timeline

- 2026-05-05: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched

## References

- [https://api.github.com/users/Jvr2022](https://api.github.com/users/Jvr2022)
- [https://github.com/Jvr2022](https://github.com/Jvr2022)
- [https://api.github.com/users/Jvr2022/gists%7B/gist_id%7D](https://api.github.com/users/Jvr2022/gists%7B/gist_id%7D)
- [https://api.github.com/users/Jvr2022/repos](https://api.github.com/users/Jvr2022/repos)
- [https://avatars.githubusercontent.com/u/109031036?v=4](https://avatars.githubusercontent.com/u/109031036?v=4)
- [https://api.github.com/users/Jvr2022/events%7B/privacy%7D](https://api.github.com/users/Jvr2022/events%7B/privacy%7D)

## Related threats

- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri URI scheme spoofing via percent-encoded scheme](https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri host confusion via unchecked WHATWG canonicalization](https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri mailto header injection via percent-encoded field-name desynchronization](https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name)