[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fast-uri@>=3.0.0 <3.1.6	[^3.1.6 → ^3.1.9](https://renovatebot.com/diffs/npm/fast-uri@>=3.0.0 <3.1.6/3.1.6/3.1.9)

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

CVE-2026-110725 / GHSA-333x-w4r6-6crp

More information

Details

Impact

fast-uri's serialize(), normalize(), and resolve(), when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a path-noscheme reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. fast-uri's default serialization escapes that colon, but the suffix path does not.

For example, normalize('javascript:alert(1)', { reference: 'suffix' }) returns javascript:alert(1), which reparses as a live javascript: scheme; data: and vbscript: behave the same.

Applications that serialize or normalize a relative reference with reference: 'suffix' and then treat the result as a URI can turn inert input into a live javascript:, data:, or vbscript: URL (a cross-site scripting vector), and equal() can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default reference: 'suffix' option.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Do not use the reference: 'suffix' option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp
• https://nvd.nist.gov/vuln/detail/CVE-2026-110725
• https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e
• https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/releases/tag/v2.4.8
• https://github.com/fastify/fast-uri/releases/tag/v3.1.9
• https://github.com/fastify/fast-uri/releases/tag/v4.2.3
• https://github.com/advisories/GHSA-333x-w4r6-6crp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

CVE-2026-110180 / GHSA-wjr9-j795-jxcr

More information

Details

Impact

fast-uri versions >= 2.4.2, <= 2.4.7, >= 3.1.3, <= 3.1.8, and >= 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser with no error set: data before an @ is dropped and whitespace is removed.

For example, fast-uri parses http://a@b@evil.example/ to host evil.example (dropping the b segment), and a host containing a raw TAB, CR, or LF has those characters stripped. equal() then treats a whitespace-smuggled host as the same as the clean one, and resolve() rewrites the authority the same way.

Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host fast-uri returns differs from what was checked, and traffic can be steered to an unintended destination.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Reject URIs whose authority contains more than one @, or contains TAB, CR, or LF, before calling fast-uri. Alternatively, treat any non-empty parse(x).error as fatal, and compare hosts only from the same parse() result.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr
• https://nvd.nist.gov/vuln/detail/CVE-2026-110180
• https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a
• https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c
• https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/releases/tag/v2.4.8
• https://github.com/fastify/fast-uri/releases/tag/v3.1.9
• https://github.com/fastify/fast-uri/releases/tag/v4.2.3
• https://github.com/advisories/GHSA-wjr9-j795-jxcr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to improper path equivalence in relative reference normalization

CVE-2026-110095 / GHSA-xhq7-xmqj-769h

More information

Details

Impact

fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one.

For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)) points at a different resource than resolve(base, ref), and equal() treats distinct references as the same.

Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h
• https://nvd.nist.gov/vuln/detail/CVE-2026-110095
• https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47
• https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9
• https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058
• https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd
• https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a
• https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/releases/tag/v2.4.8
• https://github.com/fastify/fast-uri/releases/tag/v3.1.9
• https://github.com/fastify/fast-uri/releases/tag/v4.2.3
• https://github.com/advisories/GHSA-xhq7-xmqj-769h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

CVE-2026-110306 / GHSA-w74x-v6f9-j3xg

More information

Details

Impact

fast-uri percent-decodes the scheme component with the legacy global unescape() before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but fast-uri does.

For example, normalize('%6Aavascript:alert(1)') returns javascript:alert(1), resolve('https://a.example/', '%6Aavascript:alert(1)') returns javascript:alert(1), and parse('%6Aavascript:alert(1)').scheme returns javascript. The %uXXXX form (%u006Aavascript:) produces the same result, and equal('%68ttp://a/', 'http://a/') returns true.

An application that screens dangerous schemes on the raw input and then stores or renders normalize(input) or resolve(base, input) turns an inert string into an executable javascript:, data:, or vbscript: URL, a stored or reflected cross-site scripting vector in the consuming application. equal() also treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Reject input whose scheme part (before the first :, and before any /, ?, or #) contains %. Alternatively, check parse(x).scheme against an allowlist after normalization and use that same parsed result rather than the raw string.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg
• https://nvd.nist.gov/vuln/detail/CVE-2026-110306
• https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4
• https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3
• https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/releases/tag/v2.4.8
• https://github.com/fastify/fast-uri/releases/tag/v3.1.9
• https://github.com/fastify/fast-uri/releases/tag/v4.2.3
• https://github.com/advisories/GHSA-w74x-v6f9-j3xg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fast-uri (fast-uri@>=3.0.0 <3.1.6)

v3.1.9

Compare Source

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: enable trusted publishing releases (v3.x) by @​mcollina in #​229

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

v3.1.8

Compare Source

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

• GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

Compare Source

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: tools/make-sbom/pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (222 entries)...
✗ Lockfile failed supply-chain policy check (222 entries in 586ms)
[ERR_PNPM_FETCH_401] GET https://npm.pkg.github.com/@devexpress%2Fsbom-toolkit: Unauthorized - 401

No authorization header was set for the request.

These authorization settings were found:
@jsr:registry=https://npm.jsr.io/
@devexpress:registry=https://npm.pkg.github.com