fast-uri (npm)
Dependency-free RFC 3986 URI toolbox
Advisories
94
Latest version
4.2.3
Released Oct 19, 2026
License
BSD-3-Clause
OpenSSF Scorecard
—
How to fix
Upgrading to 4.2.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install fast-uri@4.2.3yarn
yarn add fast-uri@4.2.3pnpm
pnpm add fast-uri@4.2.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references |
Low EPSS 0.30% |
< 2.4.8 | 2.4.8 |
| GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references |
Low EPSS 0.30% |
>= 4.0.0, < 4.2.3 | 4.2.3 |
| GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references |
Low EPSS 0.30% |
>= 3.0.0, < 3.1.9 | 3.1.9 |
| GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references |
Low EPSS 0.30% |
< 2.4.8 | 2.4.8 |
| GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references |
Low EPSS 0.30% |
>= 4.0.0, < 4.2.3 | 4.2.3 |
| GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references |
Low EPSS 0.30% |
>= 3.0.0, < 3.1.9 | 3.1.9 |
| GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding |
Medium EPSS 0.25% |
< 2.4.8 | 2.4.8 |
| GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding |
Medium EPSS 0.25% |
>= 4.0.0, < 4.2.3 | 4.2.3 |
| GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding |
Medium EPSS 0.25% |
>= 3.0.0, < 3.1.9 | 3.1.9 |
| GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding |
Medium EPSS 0.25% |
< 2.4.8 | 2.4.8 |
| GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding |
Medium EPSS 0.25% |
>= 4.0.0, < 4.2.3 | 4.2.3 |
| GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding |
Medium EPSS 0.25% |
>= 3.0.0, < 3.1.9 | 3.1.9 |
| GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization |
Medium EPSS 0.26% |
>= 2.4.2, < 2.4.8 | 2.4.8 |
| GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization |
Medium EPSS 0.26% |
>= 4.0.1, < 4.2.3 | 4.2.3 |
| GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization |
Medium EPSS 0.26% |
>= 3.1.3, < 3.1.9 | 3.1.9 |
| GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization |
Medium EPSS 0.26% |
>= 2.4.2, < 2.4.8 | 2.4.8 |
| GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization |
Medium EPSS 0.26% |
>= 4.0.1, < 4.2.3 | 4.2.3 |
| GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization |
Medium EPSS 0.26% |
>= 3.1.3, < 3.1.9 | 3.1.9 |
| GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization |
Low EPSS 0.29% |
>= 4.0.0, < 4.2.3 | 4.2.3 |
| GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization |
Low EPSS 0.29% |
>= 3.0.0, < 3.1.9 | 3.1.9 |
| GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization |
Low EPSS 0.29% |
< 2.4.8 | 2.4.8 |
| GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization |
Low EPSS 0.29% |
>= 4.0.0, < 4.2.3 | 4.2.3 |
| GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization |
Low EPSS 0.29% |
>= 3.0.0, < 3.1.9 | 3.1.9 |
| GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization |
Low EPSS 0.29% |
< 2.4.8 | 2.4.8 |
| GHSA-jvvf-x445-j334 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization |
Medium EPSS 0.25% |
>= 4.1.3, < 4.1.5 | 4.1.5 |
| GHSA-jvvf-x445-j334 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization |
Medium EPSS 0.25% |
>= 4.1.3, < 4.1.5 | 4.1.5 |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets |
Medium EPSS 0.25% |
< 2.4.7 | 2.4.7 |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets |
Medium EPSS 0.25% |
>= 3.0.0, < 3.1.8 | 3.1.8 |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets |
Medium EPSS 0.25% |
< 2.4.7 | 2.4.7 |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets |
Medium EPSS 0.25% |
>= 4.0.0, < 4.1.5 | 4.1.5 |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets |
Medium EPSS 0.25% |
>= 3.0.0, < 3.1.8 | 3.1.8 |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets |
Medium EPSS 0.25% |
>= 4.0.0, < 4.1.5 | 4.1.5 |
| GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority |
High EPSS 0.38% |
>= 4.1.3, < 4.1.4 | 4.1.4 |
| GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority |
High EPSS 0.38% |
>= 3.1.6, < 3.1.7 | 3.1.7 |
| GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority |
High EPSS 0.38% |
No fix yet | |
| GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority |
High EPSS 0.38% |
No fix yet | |
| GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority |
High EPSS 0.38% |
>= 2.4.5, < 2.4.6 | 2.4.6 |
| GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority |
High EPSS 0.38% |
No fix yet | |
| GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize |
High EPSS 0.24% |
>= 4.0.0, < 4.1.4 | 4.1.4 |
| GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize |
High EPSS 0.24% |
< 2.4.6 | 2.4.6 |
| GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize |
High EPSS 0.24% |
>= 3.0.0, < 3.1.7 | 3.1.7 |
| GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize |
High EPSS 0.24% |
>= 4.0.0, < 4.1.4 | 4.1.4 |
| GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize |
High EPSS 0.24% |
< 2.4.6 | 2.4.6 |
| GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize |
High EPSS 0.24% |
>= 3.0.0, < 3.1.7 | 3.1.7 |
| GHSA-jqff-g426-hqxp fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
High EPSS 0.23% |
>= 2.3.1, < 2.4.5 | 2.4.5 |
| GHSA-jqff-g426-hqxp fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
High EPSS 0.23% |
>= 4.0.0, < 4.1.3 | 4.1.3 |
| GHSA-jqff-g426-hqxp fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
High EPSS 0.23% |
>= 3.0.0, < 3.1.6 | 3.1.6 |
| GHSA-jqff-g426-hqxp fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
High EPSS 0.23% |
>= 2.3.1, < 2.4.5 | 2.4.5 |
| GHSA-jqff-g426-hqxp fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
High EPSS 0.23% |
>= 4.0.0, < 4.1.3 | 4.1.3 |
| GHSA-jqff-g426-hqxp fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
High EPSS 0.23% |
>= 3.0.0, < 3.1.6 | 3.1.6 |
| GHSA-f65p-4m7j-42xc fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
High EPSS 0.22% |
>= 3.0.0, < 3.1.6 | 3.1.6 |
| GHSA-f65p-4m7j-42xc fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
High EPSS 0.22% |
>= 4.0.0, < 4.1.3 | 4.1.3 |
| GHSA-f65p-4m7j-42xc fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
High EPSS 0.22% |
>= 2.3.1, < 2.4.5 | 2.4.5 |
| GHSA-f65p-4m7j-42xc fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
High EPSS 0.22% |
>= 3.0.0, < 3.1.6 | 3.1.6 |
| GHSA-f65p-4m7j-42xc fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
High EPSS 0.22% |
>= 4.0.0, < 4.1.3 | 4.1.3 |
| GHSA-f65p-4m7j-42xc fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
High EPSS 0.22% |
>= 2.3.1, < 2.4.5 | 2.4.5 |
| GHSA-5jgf-p345-68v8 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references |
High EPSS 0.40% |
>= 2.4.2, < 2.4.5 | 2.4.5 |
| GHSA-5jgf-p345-68v8 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references |
High EPSS 0.40% |
>= 3.1.3, < 3.1.6 | 3.1.6 |
| GHSA-5jgf-p345-68v8 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references |
High EPSS 0.40% |
>= 4.0.1, < 4.1.3 | 4.1.3 |
| GHSA-5jgf-p345-68v8 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references |
High EPSS 0.40% |
>= 4.0.1, < 4.1.3 | 4.1.3 |
| GHSA-5jgf-p345-68v8 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references |
High EPSS 0.40% |
>= 2.4.2, < 2.4.5 | 2.4.5 |
| GHSA-5jgf-p345-68v8 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references |
High EPSS 0.40% |
>= 3.1.3, < 3.1.6 | 3.1.6 |
| GHSA-fph4-wmhf-6fwf fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
High EPSS 0.22% |
>= 3.1.2, < 3.1.6 | 3.1.6 |
| GHSA-fph4-wmhf-6fwf fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
High EPSS 0.22% |
>= 4.0.0, < 4.1.3 | 4.1.3 |
| GHSA-fph4-wmhf-6fwf fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
High EPSS 0.22% |
>= 2.4.1, < 2.4.5 | 2.4.5 |
| GHSA-fph4-wmhf-6fwf fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
High EPSS 0.22% |
>= 3.1.2, < 3.1.6 | 3.1.6 |
| GHSA-fph4-wmhf-6fwf fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
High EPSS 0.22% |
>= 2.4.1, < 2.4.5 | 2.4.5 |
| GHSA-fph4-wmhf-6fwf fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
High EPSS 0.22% |
>= 4.0.0, < 4.1.3 | 4.1.3 |
| GHSA-7p8r-x3mc-p8w7 fast-uri vulnerable to host confusion via backslash authority introducer |
High EPSS 0.38% |
>= 3.0.0, < 3.1.5 | 3.1.5 |
| GHSA-7p8r-x3mc-p8w7 fast-uri vulnerable to host confusion via backslash authority introducer |
High EPSS 0.38% |
>= 4.0.0, < 4.1.2 | 4.1.2 |
| GHSA-7p8r-x3mc-p8w7 fast-uri vulnerable to host confusion via backslash authority introducer |
High EPSS 0.38% |
>= 3.0.0, < 3.1.5 | 3.1.5 |
| GHSA-7p8r-x3mc-p8w7 fast-uri vulnerable to host confusion via backslash authority introducer |
High EPSS 0.38% |
< 2.4.4 | 2.4.4 |
| GHSA-7p8r-x3mc-p8w7 fast-uri vulnerable to host confusion via backslash authority introducer |
High EPSS 0.38% |
>= 4.0.0, < 4.1.2 | 4.1.2 |
| GHSA-7p8r-x3mc-p8w7 fast-uri vulnerable to host confusion via backslash authority introducer |
High EPSS 0.38% |
< 2.4.4 | 2.4.4 |
| GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter |
High EPSS 0.44% |
>= 3.0.0, <= 3.1.3 | No fix yet |
| GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter |
High EPSS 0.44% |
>= 4.0.0, <= 4.1.0 | No fix yet |
| GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter |
High EPSS 0.44% |
>= 2.3.1, < 2.4.3 | 2.4.3 |
| GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter |
High EPSS 0.44% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter |
High EPSS 0.44% |
>= 4.0.0, < 4.1.1 | 4.1.1 |
| GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter |
High EPSS 0.44% |
>= 2.3.1, <= 2.4.2 | No fix yet |
| GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization |
High EPSS 0.69% |
>= 4.0.0, < 4.0.1 | 4.0.1 |
| GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization |
High EPSS 0.69% |
>= 3.0.0, < 3.1.3 | 3.1.3 |
| GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization |
High EPSS 0.69% |
>= 4.0.0, < 4.0.1 | 4.0.1 |
| GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization |
High EPSS 0.69% |
>= 2.3.1, < 2.4.2 | 2.4.2 |
| GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization |
High EPSS 0.69% |
>= 3.0.0, < 3.1.3 | 3.1.3 |
| GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization |
High EPSS 0.69% |
>= 2.3.1, < 2.4.2 | 2.4.2 |
| GHSA-v39h-62p7-jpjc fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
High EPSS 0.51% |
<= 2.4.0 | No fix yet |
| GHSA-v39h-62p7-jpjc fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
High EPSS 0.51% |
< 2.4.1 | 2.4.1 |
| GHSA-v39h-62p7-jpjc fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
High EPSS 0.51% |
>= 3.0.0, < 3.1.2 | 3.1.2 |
| GHSA-v39h-62p7-jpjc fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
High EPSS 0.51% |
>= 3.0.0, <= 3.1.1 | No fix yet |
| GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments |
High EPSS 0.63% |
<= 2.4.0 | No fix yet |
| GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments |
High EPSS 0.63% |
< 2.4.1 | 2.4.1 |
| GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments |
High EPSS 0.63% |
>= 3.0.0, < 3.1.1 | 3.1.1 |
| GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments |
High EPSS 0.63% |
>= 3.0.0, <= 3.1.0 | No fix yet |
Source: git+https://github.com/fastify/fast-uri.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor