Technology · npm
fast-uri (npm) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 17 vulnerabilities in fast-uri (npm): 0 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110725, was published on 20 October 2026. 4 vulnerabilities in the last four weeks, up 100% on the four before (2).
- Last 7 days
- 0
- Last 90 days
- 12
- Critical, all time
- 0
- Exploited in the wild
- 0
About fast-uri (npm)
Node.js library for fast URI/URL parsing and validation.
Latest fast-uri (npm) vulnerabilities
- CVE-2026-110725: fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referenceslowCVSS 3.7EPSS 0.3%
- CVE-2026-110306: fast-uri URI scheme spoofing via percent-encoded schememediumCVSS 6.1EPSS 0.2%
- CVE-2026-110180: fast-uri host confusion via unchecked WHATWG canonicalizationmediumCVSS 4.8EPSS 0.2%
- CVE-2026-110095: fast-uri vulnerable to improper path equivalence in relative reference normalizationlowCVSS 3.7EPSS 0.2%
- CVE-2026-86818: fast-uri mailto header injection via percent-encoded field-name desynchronizationmediumCVSS 4.8EPSS 0.3%
- CVE-2026-86472: fast-uri inconsistent host case normalization via percent-encoded octetsmediumCVSS 4.8EPSS 0.3%
- CVE-2026-84394: fast-uri host confusion via unclosed bracket in authorityhighCVSS 7.5EPSS 0.4%
- CVE-2026-84292: fast-uri authority injection via unvalidated port in serializehighCVSS 7.5EPSS 0.2%
- CVE-2026-76172: fast-uri host confusion via percent-encoded scheme normalizationhighCVSS 7.5EPSS 0.4%
- CVE-2026-75975: fast-uri server-side request forgery via malformed IPv6 normalizationhighCVSS 7.5EPSS 0.4%
- CVE-2026-75931: Fastify fast-uri host confusion via skipped IDN canonicalizationhighCVSS 7.5EPSS 0.4%
- CVE-2026-75899: fast-uri server-side request forgery via double percent-decodinghighCVSS 7.5EPSS 0.4%
- CVE-2026-18446: fast-uri host confusion via backslash authority introducerhighCVSS 7.5EPSS 0.2%
- CVE-2026-16221: fastify fast-uri host confusion via backslash authority delimiterhighCVSS 7.5EPSS 0.3%
- CVE-2026-13676: fastify fast-uri host confusion via failed IDN canonicalizationhighCVSS 7.5EPSS 0.5%
- CVE-2026-6322: Fastify fast-uri host confusion via percent-encoded authority delimitershighCVSS 7.5EPSS 0.7%
- CVE-2026-6321: OpenJS Foundation fast-uri path traversal via percent-encoded dot segmentshighCVSS 7.5EPSS 0.8%
Most severe fast-uri (npm) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-6321: OpenJS Foundation fast-uri path traversal via percent-encoded dot segmentshighCVSS 7.5EPSS 0.8%
- CVE-2026-6322: Fastify fast-uri host confusion via percent-encoded authority delimitershighCVSS 7.5EPSS 0.7%
- CVE-2026-13676: fastify fast-uri host confusion via failed IDN canonicalizationhighCVSS 7.5EPSS 0.5%
- CVE-2026-76172: fast-uri host confusion via percent-encoded scheme normalizationhighCVSS 7.5EPSS 0.4%
- CVE-2026-75931: Fastify fast-uri host confusion via skipped IDN canonicalizationhighCVSS 7.5EPSS 0.4%
- CVE-2026-84394: fast-uri host confusion via unclosed bracket in authorityhighCVSS 7.5EPSS 0.4%
- CVE-2026-75975: fast-uri server-side request forgery via malformed IPv6 normalizationhighCVSS 7.5EPSS 0.4%
- CVE-2026-75899: fast-uri server-side request forgery via double percent-decodinghighCVSS 7.5EPSS 0.4%
- CVE-2026-16221: fastify fast-uri host confusion via backslash authority delimiterhighCVSS 7.5EPSS 0.3%
- CVE-2026-84292: fast-uri authority injection via unvalidated port in serializehighCVSS 7.5EPSS 0.2%
Vulnerabilities per week
4 vulnerabilities in the last four weeks, up 100% on the four before (2). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 4 | 0 | |
| 31 Aug 2026 | 2 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 2 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 4 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many fast-uri (npm) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/npm-fast-uri)<a href="https://junglewise.ai/threats/technologies/npm-fast-uri"><img src="https://junglewise.ai/threats/technologies/npm-fast-uri/badge.svg" alt="fast-uri (npm) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/npm-fast-uri.json, and this page as text at https://junglewise.ai/threats/technologies/npm-fast-uri.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "fast-uri (npm) vulnerabilities", https://junglewise.ai/threats/technologies/npm-fast-uri, 13 November 2026.