CVE-2026-110306

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.8 fast-uri versions 3.0.0 through 3.1.8 fast-uri versions 4.0.0 through 4.2.2

Description The software percent-decodes the scheme component using the legacy global unescape() function before validation. This allows inputs with percent-encoded schemes to be emitted as live schemes, contradicting RFC 3986. Applications that screen raw input for dangerous schemes but store or render the normalized result may inadvertently allow the creation of executable javascript, data, or vbscript URLs, leading to stored or reflected cross-site scripting. Additionally, the equal() function treats encoded and plain schemes as identical, which can be used to bypass equality-based allowlists.

Recommendations Update to version 2.4.8 or later. Update to version 3.1.9 or later. Update to version 4.2.3 or later. Reject input where the scheme part contains a percent sign. Verify the parsed scheme against an allowlist after normalization and use the parsed result instead of the raw string.