{"schema_version":1,"title":"fast-uri (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 17 vulnerabilities in fast-uri (npm): 0 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110725, was published on 20 October 2026. 4 vulnerabilities in the last four weeks, up 100% on the four before (2).","url":"https://junglewise.ai/threats/technologies/npm-fast-uri","json_url":"https://junglewise.ai/threats/technologies/npm-fast-uri.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/npm-fast-uri","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":11,"all_time":17,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":4,"last_90_days":12,"last_365_days":17},"latest":[{"cve":"CVE-2026-110725","cvss":3.7,"epss":0.0025,"slug":"cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer","title":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","severity":"low","exploited":false,"published_at":"2026-10-20T07:17:08.937+00:00","url":"https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer"},{"cve":"CVE-2026-110306","cvss":6.1,"epss":0.002,"slug":"cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer","title":"fast-uri URI scheme spoofing via percent-encoded scheme","severity":"medium","exploited":false,"published_at":"2026-10-20T07:17:08.81+00:00","url":"https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer"},{"cve":"CVE-2026-110180","cvss":4.8,"epss":0.0021,"slug":"cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer","title":"fast-uri host confusion via unchecked WHATWG canonicalization","severity":"medium","exploited":false,"published_at":"2026-10-20T07:17:08.687+00:00","url":"https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer"},{"cve":"CVE-2026-110095","cvss":3.7,"epss":0.0023,"slug":"cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer","title":"fast-uri vulnerable to improper path equivalence in relative reference normalization","severity":"low","exploited":false,"published_at":"2026-10-20T07:17:08.55+00:00","url":"https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer"},{"cve":"CVE-2026-86818","cvss":4.8,"epss":0.0025,"slug":"cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name","title":"fast-uri mailto header injection via percent-encoded field-name desynchronization","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:12.453+00:00","url":"https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name"},{"cve":"CVE-2026-86472","cvss":4.8,"epss":0.0025,"slug":"cve-2026-86472-fast-uri-inconsistent-host-case-normalization-via-percent-encoded","title":"fast-uri inconsistent host case normalization via percent-encoded octets","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:12.327+00:00","url":"https://junglewise.ai/threats/cve-2026-86472-fast-uri-inconsistent-host-case-normalization-via-percent-encoded"},{"cve":"CVE-2026-84394","cvss":7.5,"epss":0.0038,"slug":"cve-2026-84394-fast-uri-host-confusion-via-unclosed-bracket-in-authority","title":"fast-uri host confusion via unclosed bracket in authority","severity":"high","exploited":false,"published_at":"2026-09-03T05:16:38.68+00:00","url":"https://junglewise.ai/threats/cve-2026-84394-fast-uri-host-confusion-via-unclosed-bracket-in-authority"},{"cve":"CVE-2026-84292","cvss":7.5,"epss":0.0024,"slug":"cve-2026-84292-fast-uri-authority-injection-via-unvalidated-port-in-serialize","title":"fast-uri authority injection via unvalidated port in serialize","severity":"high","exploited":false,"published_at":"2026-09-02T20:17:39.543+00:00","url":"https://junglewise.ai/threats/cve-2026-84292-fast-uri-authority-injection-via-unvalidated-port-in-serialize"},{"cve":"CVE-2026-76172","cvss":7.5,"epss":0.004,"slug":"cve-2026-76172-fast-uri-host-confusion-via-percent-encoded-scheme-normalization","title":"fast-uri host confusion via percent-encoded scheme normalization","severity":"high","exploited":false,"published_at":"2026-08-24T11:16:40.723+00:00","url":"https://junglewise.ai/threats/cve-2026-76172-fast-uri-host-confusion-via-percent-encoded-scheme-normalization"},{"cve":"CVE-2026-75975","cvss":7.5,"epss":0.0038,"slug":"cve-2026-75975-fast-uri-server-side-request-forgery-via-malformed-ipv6","title":"fast-uri server-side request forgery via malformed IPv6 normalization","severity":"high","exploited":false,"published_at":"2026-08-24T10:16:40.237+00:00","url":"https://junglewise.ai/threats/cve-2026-75975-fast-uri-server-side-request-forgery-via-malformed-ipv6"},{"cve":"CVE-2026-75931","cvss":7.5,"epss":0.004,"slug":"cve-2026-75931-fastify-fast-uri-host-confusion-via-skipped-idn-canonicalization","title":"Fastify fast-uri host confusion via skipped IDN canonicalization","severity":"high","exploited":false,"published_at":"2026-08-24T10:16:40.113+00:00","url":"https://junglewise.ai/threats/cve-2026-75931-fastify-fast-uri-host-confusion-via-skipped-idn-canonicalization"},{"cve":"CVE-2026-75899","cvss":7.5,"epss":0.0038,"slug":"cve-2026-75899-fast-uri-server-side-request-forgery-via-double-percent-decoding","title":"fast-uri server-side request forgery via double percent-decoding","severity":"high","exploited":false,"published_at":"2026-08-24T10:16:39.96+00:00","url":"https://junglewise.ai/threats/cve-2026-75899-fast-uri-server-side-request-forgery-via-double-percent-decoding"},{"cve":"CVE-2026-18446","cvss":7.5,"epss":0.0022,"slug":"cve-2026-18446-fast-uri-host-confusion-via-backslash-authority-introducer","title":"fast-uri host confusion via backslash authority introducer","severity":"high","exploited":false,"published_at":"2026-07-31T15:16:27.983+00:00","url":"https://junglewise.ai/threats/cve-2026-18446-fast-uri-host-confusion-via-backslash-authority-introducer"},{"cve":"CVE-2026-16221","cvss":7.5,"epss":0.0025,"slug":"cve-2026-16221-fastify-fast-uri-host-confusion-via-backslash-authority-delimiter","title":"fastify fast-uri host confusion via backslash authority delimiter","severity":"high","exploited":false,"published_at":"2026-07-19T15:16:49.027+00:00","url":"https://junglewise.ai/threats/cve-2026-16221-fastify-fast-uri-host-confusion-via-backslash-authority-delimiter"},{"cve":"CVE-2026-13676","cvss":7.5,"epss":0.0048,"slug":"cve-2026-13676-fastify-fast-uri-host-confusion-via-failed-idn-canonicalization","title":"fastify fast-uri host confusion via failed IDN canonicalization","severity":"high","exploited":false,"published_at":"2026-06-29T14:16:47.967+00:00","url":"https://junglewise.ai/threats/cve-2026-13676-fastify-fast-uri-host-confusion-via-failed-idn-canonicalization"},{"cve":"CVE-2026-6322","cvss":7.5,"epss":0.0068,"slug":"cve-2026-6322-fastify-fast-uri-host-confusion-via-percent-encoded-authority","title":"Fastify fast-uri host confusion via percent-encoded authority delimiters","severity":"high","exploited":false,"published_at":"2026-05-05T11:16:33.36+00:00","url":"https://junglewise.ai/threats/cve-2026-6322-fastify-fast-uri-host-confusion-via-percent-encoded-authority"},{"cve":"CVE-2026-6321","cvss":7.5,"epss":0.0077,"slug":"cve-2026-6321-openjs-foundation-fast-uri-path-traversal-via-percent-encoded-dot","title":"OpenJS Foundation fast-uri path traversal via percent-encoded dot segments","severity":"high","exploited":false,"published_at":"2026-05-04T20:16:20.95+00:00","url":"https://junglewise.ai/threats/cve-2026-6321-openjs-foundation-fast-uri-path-traversal-via-percent-encoded-dot"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"openclaw (npm)","slug":"npm-openclaw","vulnerabilities":214,"url":"https://junglewise.ai/threats/technologies/npm-openclaw"},{"name":"flowise (npm)","slug":"flowise","vulnerabilities":133,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":117,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":111,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"electron (npm)","slug":"electron","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/electron"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"n8n (npm)","slug":"npm-n8n","vulnerabilities":64,"url":"https://junglewise.ai/threats/technologies/npm-n8n"},{"name":"hono (npm)","slug":"hono","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"directus (npm)","slug":"directus","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"undici (npm)","slug":"undici","vulnerabilities":53,"url":"https://junglewise.ai/threats/technologies/undici"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/budibase-server"}],"technology":{"hub":true,"name":"fast-uri (npm)","slug":"npm-fast-uri","vendor":{"hub":true,"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"description":"Node.js library for fast URI/URL parsing and validation.","url":"https://junglewise.ai/threats/technologies/npm-fast-uri"},"most_severe":[{"cve":"CVE-2026-6321","cvss":7.5,"epss":0.0077,"slug":"cve-2026-6321-openjs-foundation-fast-uri-path-traversal-via-percent-encoded-dot","title":"OpenJS Foundation fast-uri path traversal via percent-encoded dot segments","severity":"high","exploited":false,"published_at":"2026-05-04T20:16:20.95+00:00","url":"https://junglewise.ai/threats/cve-2026-6321-openjs-foundation-fast-uri-path-traversal-via-percent-encoded-dot"},{"cve":"CVE-2026-6322","cvss":7.5,"epss":0.0068,"slug":"cve-2026-6322-fastify-fast-uri-host-confusion-via-percent-encoded-authority","title":"Fastify fast-uri host confusion via percent-encoded authority delimiters","severity":"high","exploited":false,"published_at":"2026-05-05T11:16:33.36+00:00","url":"https://junglewise.ai/threats/cve-2026-6322-fastify-fast-uri-host-confusion-via-percent-encoded-authority"},{"cve":"CVE-2026-13676","cvss":7.5,"epss":0.0048,"slug":"cve-2026-13676-fastify-fast-uri-host-confusion-via-failed-idn-canonicalization","title":"fastify fast-uri host confusion via failed IDN canonicalization","severity":"high","exploited":false,"published_at":"2026-06-29T14:16:47.967+00:00","url":"https://junglewise.ai/threats/cve-2026-13676-fastify-fast-uri-host-confusion-via-failed-idn-canonicalization"},{"cve":"CVE-2026-76172","cvss":7.5,"epss":0.004,"slug":"cve-2026-76172-fast-uri-host-confusion-via-percent-encoded-scheme-normalization","title":"fast-uri host confusion via percent-encoded scheme normalization","severity":"high","exploited":false,"published_at":"2026-08-24T11:16:40.723+00:00","url":"https://junglewise.ai/threats/cve-2026-76172-fast-uri-host-confusion-via-percent-encoded-scheme-normalization"},{"cve":"CVE-2026-75931","cvss":7.5,"epss":0.004,"slug":"cve-2026-75931-fastify-fast-uri-host-confusion-via-skipped-idn-canonicalization","title":"Fastify fast-uri host confusion via skipped IDN canonicalization","severity":"high","exploited":false,"published_at":"2026-08-24T10:16:40.113+00:00","url":"https://junglewise.ai/threats/cve-2026-75931-fastify-fast-uri-host-confusion-via-skipped-idn-canonicalization"},{"cve":"CVE-2026-84394","cvss":7.5,"epss":0.0038,"slug":"cve-2026-84394-fast-uri-host-confusion-via-unclosed-bracket-in-authority","title":"fast-uri host confusion via unclosed bracket in authority","severity":"high","exploited":false,"published_at":"2026-09-03T05:16:38.68+00:00","url":"https://junglewise.ai/threats/cve-2026-84394-fast-uri-host-confusion-via-unclosed-bracket-in-authority"},{"cve":"CVE-2026-75975","cvss":7.5,"epss":0.0038,"slug":"cve-2026-75975-fast-uri-server-side-request-forgery-via-malformed-ipv6","title":"fast-uri server-side request forgery via malformed IPv6 normalization","severity":"high","exploited":false,"published_at":"2026-08-24T10:16:40.237+00:00","url":"https://junglewise.ai/threats/cve-2026-75975-fast-uri-server-side-request-forgery-via-malformed-ipv6"},{"cve":"CVE-2026-75899","cvss":7.5,"epss":0.0038,"slug":"cve-2026-75899-fast-uri-server-side-request-forgery-via-double-percent-decoding","title":"fast-uri server-side request forgery via double percent-decoding","severity":"high","exploited":false,"published_at":"2026-08-24T10:16:39.96+00:00","url":"https://junglewise.ai/threats/cve-2026-75899-fast-uri-server-side-request-forgery-via-double-percent-decoding"},{"cve":"CVE-2026-16221","cvss":7.5,"epss":0.0025,"slug":"cve-2026-16221-fastify-fast-uri-host-confusion-via-backslash-authority-delimiter","title":"fastify fast-uri host confusion via backslash authority delimiter","severity":"high","exploited":false,"published_at":"2026-07-19T15:16:49.027+00:00","url":"https://junglewise.ai/threats/cve-2026-16221-fastify-fast-uri-host-confusion-via-backslash-authority-delimiter"},{"cve":"CVE-2026-84292","cvss":7.5,"epss":0.0024,"slug":"cve-2026-84292-fast-uri-authority-injection-via-unvalidated-port-in-serialize","title":"fast-uri authority injection via unvalidated port in serialize","severity":"high","exploited":false,"published_at":"2026-09-02T20:17:39.543+00:00","url":"https://junglewise.ai/threats/cve-2026-84292-fast-uri-authority-injection-via-unvalidated-port-in-serialize"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}