GHSA-v39h-62p7-jpjc

    Dashboard / Vulnerabilities / GHSA-v39h-62p7-jpjc

    GHSA-v39h-62p7-jpjc

    Published: 8 May 2026Last Modified: 10 Sept 2026
    Aliases:
    CVE-2026-6322

    Summary: fast-uri vulnerable to host confusion via percent-encoded authority delimiters

    Details: ### Impact `fast-uri` v3.1.1 and earlier decodes percent-encoded authority delimiters (`%40` as `@`, `%3A` as `:`) inside the host component and serializes them back as raw characters. This changes the URI structure, turning a hostname into userinfo plus a different host. For example, `http://trusted.com%40evil.com/` normalizes to `http://[email protected]/`, which reparses as host `evil.com` with userinfo `trusted.com`. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the original URL appeared to contain. ### Patches Upgrade to `fast-uri` >= 3.1.2, or if you are in the v2.x release line, v2.4.1 ### Workarounds None. Upgrade to the patched version.

    References: https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc, https://nvd.nist.gov/vuln/detail/CVE-2026-6322, https://access.redhat.com/errata/RHSA-2026:41928, https://access.redhat.com/errata/RHSA-2026:41951, https://access.redhat.com/errata/RHSA-2026:42078, https://access.redhat.com/errata/RHSA-2026:42142, https://access.redhat.com/errata/RHSA-2026:43038, https://access.redhat.com/errata/RHSA-2026:54395, https://access.redhat.com/errata/RHSA-2026:54555, https://access.redhat.com/errata/RHSA-2026:56366, https://access.redhat.com/errata/RHSA-2026:56431, https://access.redhat.com/errata/RHSA-2026:56928, https://access.redhat.com/errata/RHSA-2026:56968, https://access.redhat.com/errata/RHSA-2026:57013, https://access.redhat.com/errata/RHSA-2026:57487, https://access.redhat.com/errata/RHSA-2026:60520, https://access.redhat.com/errata/RHSA-2026:60855, https://access.redhat.com/errata/RHSA-2026:61783, https://access.redhat.com/security/cve/CVE-2026-6322, https://bugzilla.redhat.com/show_bug.cgi?id=2466684, https://cna.openjsf.org/security-advisories.html, https://github.com/fastify/fast-uri, https://github.com/fastify/fast-uri/releases/tag/v2.4.1, https://github.com/fastify/fast-uri/releases/tag/v3.1.2, https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6322.json, https://access.redhat.com/errata/RHSA-2026:25271, https://access.redhat.com/errata/RHSA-2026:25273, https://access.redhat.com/errata/RHSA-2026:26225, https://access.redhat.com/errata/RHSA-2026:26234, https://access.redhat.com/errata/RHSA-2026:28571, https://access.redhat.com/errata/RHSA-2026:29197, https://access.redhat.com/errata/RHSA-2026:29795, https://access.redhat.com/errata/RHSA-2026:29796, https://access.redhat.com/errata/RHSA-2026:29800, https://access.redhat.com/errata/RHSA-2026:29834, https://access.redhat.com/errata/RHSA-2026:30076, https://access.redhat.com/errata/RHSA-2026:33683, https://access.redhat.com/errata/RHSA-2026:34160, https://access.redhat.com/errata/RHSA-2026:34342, https://access.redhat.com/errata/RHSA-2026:34374, https://access.redhat.com/errata/RHSA-2026:34766, https://access.redhat.com/errata/RHSA-2026:34770, https://access.redhat.com/errata/RHSA-2026:36651, https://access.redhat.com/errata/RHSA-2026:36754, https://access.redhat.com/errata/RHSA-2026:37186, https://access.redhat.com/errata/RHSA-2026:37385, https://access.redhat.com/errata/RHSA-2026:37628, https://access.redhat.com/errata/RHSA-2026:40118, https://access.redhat.com/errata/RHSA-2026:40945, https://access.redhat.com/errata/RHSA-2026:41066

    Affected packages

    Package

    Name: fast-uri

    Purl: pkg:npm/fast-uri

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 3.0.0
    Fixed -3.1.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-v39h-62p7-jpjc | CVE-DB