fast-uri maintainers disclosed CVE-2026-110306 on October 19, 2026, describing an application scheme validation bypass involving encoded uniform resource identifier (URI) schemes. According to the advisory, applications that validate raw input before rendering a transformed URI can expose a cross-site scripting path. Sources: fastify/fast-uri
The advisory attributes the flaw to legacy unescape() behavior that decodes the scheme before validation, accepting encodings that the URI standard RFC 3986 prohibits. Its example shows normalize('%6Aavascript:alert(1)') producing javascript:alert(1), and it also documents encoded-scheme handling in parse(), resolve() and equal(). Sources: fastify/fast-uri
Affected versions are those below 2.4.8, versions from 3.0.0 up to but excluding 3.1.9, and versions from 4.0.0 up to but excluding 4.2.3. The advisory lists 2.4.8, 3.1.9 and 4.2.3 as fixed releases. Sources: fastify/fast-uri
The maintainer advisory describes an allowlist bypass when applications treat encoded and plain schemes as equivalent. Sources: fastify/fast-uri
What to do
- Upgrade affected fast-uri installations to the fixed release for their version line: 2.4.8, 3.1.9 or 4.2.3. Sources: fastify/fast-uri