CVE-2026-110725

What it actually does

When serialize(), normalize(), or resolve() are invoked with the non-default reference=suffix option on an authority-less reference, the output relative reference may contain an unescaped bare colon in its first path segment. This violates RFC 3986 and allows the string to be re-parsed as an absolute URI with a scheme (javascript:, data:, vbscript:), enabling injection of executable content; equal() may also conflate scheme-bearing and relative references.

Why it matters to the business

Applications that rely on fast-uri to produce safe relative references for later use as URIs can inadvertently create XSS vectors or allow scheme injection from untrusted input, leading to client-side code execution or broken access-control logic in web or API contexts.

How an attack unfolds

An attacker supplies a crafted relative reference lacking an authority component to an application that calls serialize/normalize/resolve with reference=suffix; the library emits a string containing an unescaped colon in the first path segment; the consuming application then treats this string as a URI, causing a javascript/data/vbscript scheme to be interpreted and executed in the browser or other URI handler.

How to fix it

Upgrade fast-uri to 2.4.8, 3.1.9, or 4.2.3 (or later). As a temporary mitigation, avoid the suffix reference option when processing untrusted input, or percent-encode any colon that appears in the first path segment of the result before treating it as a URI.

How to confirm the fix worked

Confirm the installed fast-uri version is at least 2.4.8, 3.1.9, or 4.2.3; run the library's test suite with reference=suffix inputs containing colons to verify no bare-colon output is produced; scan application code for calls that pass the suffix option on untrusted data.

Typical attack path

1. Identify an endpoint or function that passes untrusted data into fast-uri serialize/normalize/resolve with reference=suffix
2. Craft input containing a relative reference whose first path segment begins with a colon-bearing payload
3. Obtain the library output and supply it to a context that interprets the result as a URI
4. Trigger execution of the injected javascript/data/vbscript scheme

How to detect it

Search application logs or request histories for URI strings generated after calls to serialize/normalize/resolve that contain a bare colon immediately after a path separator; review any downstream URI parsing or navigation that receives output from fast-uri with the suffix option.

What your security team should do

• Immediately inventory all Node.js applications and packages that depend on fast-uri and schedule upgrades to 2.4.8 / 3.1.9 / 4.2.3
• Add a dependency check or SCA policy to block future builds that use vulnerable fast-uri versions
• Review code for any use of the suffix reference option and replace or guard those call sites