FA
Product
fast-uri
17
CVEs
0
On KEV
7.5
Max CVSS
4
New 30D
Severity mix
Critical 0High 11Medium 4Low 2
Watch
Add fast-uri to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-84394 | 7.5 | Sep 2 | fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority Affected: 2.4.5 before 2.4.6; 3.1.6 before 3.1.7; 4.1.3 before 4.1.4 |
| CVE-2026-84292 | 7.5 | Sep 2 | fast-uri vulnerable to authority injection via an unvalidated port in serialize Affected: before 2.4.6; 3.0.0 before 3.1.7; 4.0.0 before 4.1.4 |
| CVE-2026-76172 | 7.5 | Aug 24 | fast-uri vulnerable to host confusion via percent-encoded scheme normalization Affected: 2.3.1 before 2.4.5; 3.0.0 before 3.1.6; 4.0.0 before 4.1.3 |
| CVE-2026-75975 | 7.5 | Aug 24 | fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization Affected: 2.3.1 before 2.4.5; 3.0.0 before 3.1.6; 4.0.0 before 4.1.3 |
| CVE-2026-75899 | 7.5 | Aug 24 | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding Affected: 2.4.1 before 2.4.5; 3.1.2 before 3.1.6; 4.0.0 before 4.1.3 |
| CVE-2026-75931 | 7.5 | Aug 24 | fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references Affected: 2.4.2 before 2.4.5; 3.1.3 before 3.1.6; 4.0.1 before 4.1.3 |
| CVE-2026-18446 | 7.5 | Jul 31 | fast-uri vulnerable to host confusion via backslash authority introducer Affected: 4.0.0 before 4.1.2; 3.0.0 before 3.1.5; before 2.4.4 |
| CVE-2026-16221 | 7.5 | Jul 19 | fast-uri vulnerable to host confusion via literal backslash authority delimiter Affected: 2.3.1 before 2.4.3; 3.0.0 before 3.1.4; 4.0.0 before 4.1.1 |
| CVE-2026-13676 | 7.5 | Jun 29 | fast-uri vulnerable to host confusion via failed IDN canonicalization Affected: 4.0.0 before 4.0.1; 2.3.1 before 3.1.3 |
| CVE-2026-6322 | 7.5 | May 5 | fast-uri vulnerable to host confusion via percent-encoded authority delimiters Affected: before 3.1.2 |
| CVE-2026-6321 | 7.5 | May 4 | fast-uri vulnerable to path traversal via percent-encoded dot segments Affected: before 3.1.1 |
| CVE-2026-110306 | 6.1 | Oct 20 | fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding Affected: before 2.4.8; 3.0.0 before 3.1.9; 4.0.0 before 4.2.3 |
| CVE-2026-110180 | 4.8 | Oct 20 | fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization Affected: 2.4.2 before 2.4.8; 3.1.3 before 3.1.9; 4.0.1 before 4.2.3 |
| CVE-2026-86818 | 4.8 | Sep 15 | fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization Affected: 4.1.3 before 4.1.5 |
| CVE-2026-86472 | 4.8 | Sep 15 | fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets Affected: before 2.4.7; 3.0.0 before 3.1.8; 4.0.0 before 4.1.5 |
| CVE-2026-110725 | 3.7 | Oct 20 | fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references Affected: before 2.4.8; 3.0.0 before 3.1.9; 4.0.0 before 4.2.3 |
| CVE-2026-110095 | 3.7 | Oct 20 | fast-uri vulnerable to improper path equivalence in relative reference normalization Affected: before 2.4.8; 3.0.0 before 3.1.9; 4.0.0 before 4.2.3 |
Showing 17