CVE-2026-110725 fast-uri CVE debrief

Who should care

Developers using fast-uri in their applications, especially those using the non-default suffix reference option, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

The fast-uri vulnerability allows for scheme injection via an unescaped first-segment colon in suffix references, potentially leading to cross-site scripting vectors and scheme injection attacks. Developers should assess their exposure, especially if using the non-default suffix reference option, and take necessary actions to mitigate the vulnerability.

• Cross-site scripting vector via unescaped first-segment colon in suffix references
• Potential for scheme injection attacks on applications using the suffix reference option
• Need for percent-encoding a colon in the first path segment of the result before treating it as a URI
• Upgrade priority to fast-uri version 2.4.8, 3.1.9, or 4.2.3 or later

Technical summary

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it.

Defensive priority

Upgrade to fast-uri version 2.4.8, 3.1.9, or 4.2.3 or later. Avoid using the suffix reference option on untrusted input. Percent-encode a colon in the first path segment of the result before treating it as a URI.

Recommended defensive actions

• Upgrade to fast-uri version 2.4.8, 3.1.9, or 4.2.3 or later
• Avoid using the suffix reference option on untrusted input
• Percent-encode a colon in the first path segment of the result before treating it as a URI
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed versions. The issue is limited to applications using the non-default suffix reference option. Evidence from the CVE Program record (CVE-2026-110725) and source item (cve_program_cvelist_v5) indicates that fast-uri versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2 are vulnerable. Developers should verify their exposure, especially if using the non-default suffix reference option, and consider upgrading to fast-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.