CVE-2026-110306

What it actually does

fast-uri percent-decodes the scheme component via legacy unescape() before validation, emitting decoded dangerous schemes (javascript:, data:, vbscript:) that RFC 3986 prohibits; equal() also equates encoded and plain schemes, bypassing raw-input allowlists and enabling normalized output to become executable URIs.

Why it matters to the business

Applications that screen raw input then store or render parsed URIs can be tricked into serving executable scripts, resulting in stored or reflected XSS that exposes user sessions and data; recent publication and rising EPSS warrant prompt attention despite low current exploit maturity.

How an attack unfolds

An attacker supplies a URI whose scheme is percent-encoded (e.g., %6a%61%76%61%73%63%72%69%70%74:), fast-uri decodes it to javascript: before validation, the application accepts the inert raw string, stores or reflects the normalized result, and the browser executes the script when the URI is later used.

How to fix it

Upgrade fast-uri to 2.4.8, 3.1.9, or 4.2.3 or later. Workaround: reject any input whose scheme component contains a percent sign, or always validate the parsed scheme against an allowlist after normalization and discard the raw string.

How to confirm the fix worked

Inspect package.json or node_modules/fast-uri/package.json for version >= 2.4.8 / 3.1.9 / 4.2.3; fuzz parse() with %6a%61%76%61%73%63%72%69%70%74: and confirm the result scheme is rejected or empty.

Typical attack path

1. Craft input URI containing percent-encoded dangerous scheme
2. Submit to endpoint that invokes fast-uri parse/resolve/normalize
3. Bypass raw-scheme screening because encoded form is inert
4. Receive or store normalized URI containing live dangerous scheme
5. Victim interaction causes browser to treat URI as executable script

How to detect it

Search web and application logs for URIs containing percent-encoded scheme prefixes; monitor for sudden appearance of javascript:, data:, or vbscript: schemes after normalization; review any code paths that compare raw versus parsed schemes.

• %6a%61%76%61%73%63%72%69%70%74:
• %64%61%74%61:
• %76%62%73%63%72%69%70%74:
• scheme contains % before fast-uri normalization

What your security team should do

• Upgrade fast-uri to a fixed release within the next sprint given 6-day publication age and rising EPSS
• Add post-normalization scheme allow-list checks in all URI-handling code paths
• Scan dependency trees for fast-uri < 2.4.8 / 3.1.9 / 4.2.3 and prioritize remediation
• Review stored URI fields for any legacy normalized javascript: or data: values