{"id":"ghsa-ghsa-333x-w4r6-6crp","seq":661316,"kind":"advisory","title":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","url":"https://github.com/advisories/GHSA-333x-w4r6-6crp","permalink":"https://vulnpulse.app/items/ghsa-ghsa-333x-w4r6-6crp","summary":"影響: npm:fast-uri < 2.4.8 → 2.4.8, npm:fast-uri >= 3.0.0, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.0, < 4.2.3 → 4.2.3\nfast-uri's serialize(), normalize(), and resolve(), when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a path-noscheme reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. fast-uri's default serialization escapes that colon, but the suf…","severity":"low","techs":["nodejs"],"cves":["CVE-2026-110725"],"tags":["GHSA-333x-w4r6-6crp","fast-uri","fast-uri","fast-uri"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:36:40.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}