CVE-2026-110306: fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.9 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.2.3 - Compensating control
As a workaround, reject input whose URI scheme contains a percent sign, or parse and normalize the scheme, validate the parsed scheme against an allowlist, and use that same parsed result instead of the raw string.
Event History
Frequently Asked Questions
Which applications are realistically exposed to exploitation?
Applications are exposed when they accept attacker-controlled URIs, screen dangerous schemes only in the raw input, and then store or render the normalized or resolved fast-uri output. This can create stored or reflected cross-site scripting through javascript, data, or vbscript URLs; equality-based scheme allowlists may also be bypassed.
Does exploitation require authentication or special access?
No authentication or privileges are required, but exploitation requires user interaction. An attacker must supply a URI with a percent-encoded scheme that becomes a dangerous scheme after fast-uri decodes and normalizes it.
What can be done if upgrading is not immediately possible?
Reject any input whose scheme portion contains a percent sign. Alternatively, parse and normalize the URI, enforce an allowlist against the parsed scheme after normalization, and use that same parsed result rather than returning to the raw input.
How can we determine whether our deployment is affected?
Check the installed fast-uri version. Versions before 2.4.8, versions from 3.0.0 through 3.1.8, and versions from 4.0.0 through 4.2.2 are affected; fixed versions are 2.4.8, 3.1.9, and 4.2.3 or later.