CVE-2026-110306
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in fast-uri URI Parser

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: openjs

Description
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-110306
EUVD
EUVD-2026-104814

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
fast-uri fast-uri 0
fast-uri fast-uri 3.0.0
fast-uri fast-uri 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-172 The product does not properly encode or decode the data, resulting in unexpected values.
CWE-180 The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

fast-uri is a URI parser for Node.js vulnerable to scheme spoofing due to improper percent-decoding of the scheme component using unescape() before validation. Attackers can bypass scheme restrictions by providing encoded schemes like %6Aavascript:alert(1), which decodes to javascript:alert(1) and is treated as valid. This allows conversion of inert strings into executable URLs such as javascript:, data:, or vbscript:.

Detection Guidance

Check the version of fast-uri in your Node.js project using 'npm list fast-uri' or 'npm ls fast-uri'. If the version is below 2.4.8, 3.1.9, or 4.2.3, the system is vulnerable. Review application code for usage of fast-uri functions like normalize(), resolve(), parse(), or equal() to identify potential exposure points.

Impact Analysis

This vulnerability can lead to stored or reflected cross-site scripting (XSS) attacks. Applications using affected functions like normalize(), resolve(), or parse() may inadvertently store or render malicious URLs, compromising user data or session integrity. The equal() function's incorrect behavior can also bypass allowlist-based security checks.

Compliance Impact

This vulnerability could lead to stored or reflected cross-site scripting (XSS) attacks by allowing malicious URLs to bypass security checks. For GDPR, this may result in unauthorized data access or disclosure if user input is improperly sanitized. For HIPAA, it could enable script injection in healthcare applications handling sensitive patient data.

Mitigation Strategies

Upgrade fast-uri to version 2.4.8, 3.1.9, or 4.2.3 or later immediately. As a temporary workaround, implement input validation to reject URIs with percent-encoded schemes or validate parsed schemes against an allowlist after normalization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...