SB20261110271 - Multiple vulnerabilities in fast-uri

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110271

SB20261110271 - Multiple vulnerabilities in fast-uri

Published: November 10, 2026

Security Bulletin ID SB20261110271
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2026-110725)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to inject URI schemes and potentially enable cross-site scripting in applications using fast-uri.

The vulnerability exists due to missing first-segment colon escaping in fast-uri's serialize(), normalize(), and resolve() functions when processing references without an authority using reference: 'suffix'. A remote attacker can supply javascript:alert(1) or references containing data: or vbscript: schemes to make output reparse as an absolute URI when treated as a URL, while equal() can conflate scheme-bearing and relative references.


2) Interpretation Conflict (CVE-ID: CVE-2026-110180)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host-based policies and steer traffic to unintended destinations.

The vulnerability exists due to an interpretation conflict in fast-uri's canonicalizeHost() when adopting the WHATWG parser's hostname without verifying that the entire input was interpreted as a host. A remote attacker can supply URLs such as http://a@b@evil.example/ or hosts containing TAB, CR, or LF to trigger host rewriting and bypass applications' policies when checks and subsequent use rely on different host representations.


3) Improper Resolution of Path Equivalence (CVE-ID: CVE-2026-110095)

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause applications to resolve relative references to unintended resources or treat distinct references as equivalent.

The vulnerability exists due to improper resolution of path equivalence in fast-uri's normalize() and serialize() functions when dot-segment removal is applied to relative references before resolution. A remote attacker can supply references such as 'a/../b' or '../x', normalized to '/b' or 'x', to escape intended directories or interfere with cache, deduplication, or authorization keys.


4) Cross-site scripting (CVE-ID: CVE-2026-110306)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to bypass scheme allowlists and execute scripts in a victim's browser through consuming applications.

The vulnerability exists due to improper decoding in fast-uri's scheme handling when unescape() decodes percent-encoded schemes before validation, turning otherwise inert input into executable URLs. A remote attacker can supply %6Aavascript:alert(1) or %u006Aavascript:alert(1) for normalization or resolution and subsequent rendering to trigger cross-site scripting upon victim interaction, or submit %68ttp://a/ to bypass equality-based allowlists through equal().


Remediation

Install update from vendor's website.

References