CVE-2026-110306 fast-uri CVE debrief

Who should care

Defenders responsible for applications that use fast-uri should assess exposure and prioritize upgrading to a fixed version. This includes reviewing applications that use fast-uri to ensure they are not vulnerable to scheme spoofing attacks. Operators, platform administrators, vulnerability management teams, and security teams should be aware of the potential risks and take necessary actions to mitigate them.

Why it matters

Defenders should prioritize upgrading to fast-uri version 2.4.8, 3.1.9, or 4.2.3, or later, and review applications that use fast-uri to ensure they are not vulnerable to scheme spoofing attacks.

• Stored or reflected cross-site scripting vectors can be produced
• Applications that screen dangerous schemes on raw input may be vulnerable
• Normalization and resolution of URIs can lead to executable URLs
• Defenders should verify affected versions and upgrade to a fixed version

Technical summary

fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, allowing an input whose decoded scheme is a dangerous token to be emitted as a live scheme. This can lead to stored or reflected cross-site scripting vectors. Affected applications may screen dangerous schemes on raw input and then store or render the normalized or resolved result, turning an inert string into an executable javascript, data, or vbscript URL. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3.

Defensive priority

Defenders should prioritize upgrading to fast-uri version 2.4.8, 3.1.9, or 4.2.3, or later, and review applications that use fast-uri to ensure they are not vulnerable to scheme spoofing attacks.

Recommended defensive actions

• Upgrade to fast-uri version 2.4.8, 3.1.9, or 4.2.3, or later
• Review applications that use fast-uri to ensure they are not vulnerable to scheme spoofing attacks
• Reject input whose scheme part contains a percent sign
• Check the parsed scheme against an allowlist after normalization
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and fixed versions. The NVD entry is currently UNCHANGED. Additional review indicates that fast-uri's percent-decoding of the scheme component before validation can lead to security issues. Defenders should verify affected versions and upgrade to a fixed version. Evidence limits suggest that further analysis is required to fully understand the vulnerability's impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.