UpHeron
All vulnerabilities

npm

CVE-2026-6322

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Severity
High 7.5
Published
8 May 2026
Last changed
10 Sept 2026
Added to UpHeron
22 Oct 2026
Fixed in
2.4.1, 3.1.2
Also known as
GHSA-v39h-62p7-jpjc
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
fast-urinpm · osv:npm:fast-uri
  • Every version before 2.4.1
  • From 3.0.0 before 3.1.2

References