CVE-2026-110725

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.8 fast-uri versions 3.0.0 through 3.1.8 fast-uri versions 4.0.0 through 4.2.2

Description When the serialize(), normalize(), or resolve() functions are called with the non-default reference option set to suffix on a reference lacking authority, the resulting relative reference may contain an unescaped bare colon in its first path segment. This violates RFC 3986, as it allows the string to be reparsed as an absolute URI with a scheme. Consequently, an application treating the result as a URI could convert inert input into active javascript, data, or vbscript URLs, creating a cross-site scripting vector. Additionally, the equal() function may incorrectly treat a scheme-bearing reference as a relative one. This issue only affects applications utilizing the non-default suffix reference option.

Recommendations Update fast-uri to version 2.4.8 or later. Update fast-uri to version 3.1.9 or later. Update fast-uri to version 4.2.3 or later. Avoid using the suffix reference option on untrusted input. Percent-encode any colon in the first path segment of the result before treating it as a URI.