{"id":"ghsa-ghsa-w74x-v6f9-j3xg","seq":661313,"kind":"advisory","title":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","url":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","permalink":"https://vulnpulse.app/items/ghsa-ghsa-w74x-v6f9-j3xg","summary":"影響: npm:fast-uri < 2.4.8 → 2.4.8, npm:fast-uri >= 3.0.0, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.0, < 4.2.3 → 4.2.3\nfast-uri percent-decodes the scheme component with the legacy global unescape() before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but fast-uri does. For example, normalize('%6Aavascript:alert(1)') returns javascript:alert(1), resolve('https://a.example/', '%6Aavascript:alert(1)') returns javascript:…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-110306"],"tags":["GHSA-w74x-v6f9-j3xg","fast-uri","fast-uri","fast-uri"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:41:36.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}