CVE-2026-110306 in fast-uri
Summary
by MITRE • 10/20/2026
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability in fast-uri stems from a critical flaw in how the library handles URI parsing and validation relative to RFC 3986 standards. Specifically, versions prior to 2.4.8, as well as ranges 3.0.0 through 3.1.8 and 4.0.0 through 4.2.2, incorrectly apply legacy global unescape functions to the scheme component of a URI before performing validation checks. This behavior deviates from RFC 3986, which explicitly prohibits percent-encoding within the scheme portion of a Uniform Resource Identifier. By decoding these characters prematurely, the parser allows inputs that would otherwise be rejected by compliant parsers or security filters expecting raw input strings to pass through as valid URIs with dangerous schemes such as javascript, data, or vbscript.
This technical flaw creates significant operational risks for applications relying on fast-uri for URI normalization and validation. When an application screens incoming requests against a list of dangerous schemes using the raw user-supplied string but subsequently stores or renders the normalized result provided by fast-uri, it inadvertently enables cross-site scripting attacks. An attacker can craft a payload where the scheme is percent-encoded in the input to bypass initial screening filters, only for the library to decode it into an executable protocol handler during normalization. This results in stored or reflected XSS vectors because the application treats the decoded scheme as safe based on its pre-decoding state while rendering the dangerous post-decode version.
Furthermore, the vulnerability extends beyond simple parsing errors into logic bypasses involving equality comparisons. The equal() method within fast-uri treats a percent-encoded scheme and its plain-text equivalent as identical for comparison purposes. This characteristic allows attackers to circumvent allowlists that rely on exact string matching of schemes. If an application maintains a whitelist of permitted protocols, it may fail to distinguish between a safe http URL and a malicious javascript:URL due to this equivalence handling, thereby allowing the execution of arbitrary code in the context of the victim's browser or client environment.
To mitigate these risks, developers must upgrade fast-uri to version 2.4.8, 3.1.9, or 4.2.3 and later, where the parsing logic has been corrected to adhere strictly to RFC 3986 constraints regarding scheme encoding. For environments unable to immediately update dependencies, a robust workaround involves implementing custom validation that rejects any URI input containing percent signs within the scheme component before passing it to the parser. Additionally, applications should validate schemes against an allowlist using the parsed and normalized output from fast-uri rather than relying on raw user inputs for security decisions. This ensures consistency between what is screened and what is ultimately processed or rendered.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation as it involves failing to correctly validate input against expected formats and standards. It also relates to CWE-79 Cross-site Scripting due to the potential for executing malicious scripts via encoded scheme bypasses. In terms of adversary tactics, this vulnerability supports techniques associated with ATT&CK T1189 Drive-by Client-Side Execution or T1059 Command and Scripting Interpreter if exploited in a context where user-controlled URIs are processed by backend systems that subsequently serve content to other users. Proper input sanitization and adherence to established URI standards remain the primary defenses against such exploitation paths.