CVE-2026-110725: fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
Impact
fast-uri's serialize(), normalize(), and resolve(), when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a path-noscheme reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. fast-uri's default serialization escapes that colon, but the suffix path does not.
For example, normalize('javascript:alert(1)', { reference: 'suffix' }) returns javascript:alert(1), which reparses as a live javascript: scheme; data: and vbscript: behave the same.
Applications that serialize or normalize a relative reference with reference: 'suffix' and then treat the result as a URI can turn inert input into a live javascript:, data:, or vbscript: URL (a cross-site scripting vector), and equal() can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default reference: 'suffix' option.
Patches
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.
Workarounds
Do not use the reference: 'suffix' option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.
Other sources
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.9 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
debian/node-ajvto a version that resolves this vulnerability.Fixed in 8.20.0~ds+~cs7.2.4-1 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.9 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.2.3 - Configuration
Do not use the non-default reference: 'suffix' option on untrusted input.
fast-uri reference = not 'suffix' for untrusted input - Compensating control
If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Exposure is limited to applications that call fast-uri serialize(), normalize(), or resolve() with the non-default reference option set to suffix. The affected reference must have no authority and contain a colon in its first path segment.
What does an attacker need to exploit it?
An attacker needs input that is processed as a relative URI reference using the suffix option and whose serialized or normalized output is later treated as a URI. A bare first-segment colon can cause that output to reparse as a scheme-bearing URI such as javascript:, data:, or vbscript:.
Are default fast-uri configurations affected?
No. The issue requires the non-default suffix reference option, so applications not using that option are not exposed through this behavior.
What can be done if an upgrade cannot be applied immediately?
Do not use the suffix reference option with untrusted input. If that cannot be avoided, percent-encode any colon in the first path segment of the generated result before treating it as a URI.
Which versions contain the fix?
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3, or a later version in the applicable release line.