CVE-2026-6322highCWE-140CWE-436

CVE-2026-6322: fallo de gravedad alta en fast-uri

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear fast-uri+ Monitorear node-ajv

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.5%
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
fast-uri · fast-uri
CVEs relacionadas — fast-uri

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-13676HIGHfast-uri vulnerable to host confusion via failed IDN canonicalizationEPSS 0.7%CVE-2026-6321HIGHfast-uri vulnerable to path traversal via percent-encoded dot segmentsEPSS 0.6%CVE-2026-16221HIGHfast-uri vulnerable to host confusion via literal backslash authority delimiterEPSS 0.4%CVE-2026-75931HIGHfast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesEPSS 0.4%CVE-2026-84394HIGHfast-uri vulnerable to host confusion via an unclosed bracket in the URI authorityEPSS 0.4%CVE-2026-18446HIGHfast-uri vulnerable to host confusion via backslash authority introducerEPSS 0.4%