Live › vulnerability › CVE-2026-110725
Go to dashboardfast-uri, an npm URI parsing library, fails to escape a colon in the first path segment when the non-default reference: 'suffix' option is used, so a relative reference like javascript:alert(1) reparses as a live javascript: URL. An attacker who controls the input that the application serializes or normalizes can produce a cross-site scripting vector.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:39 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| fast-uri | npm | < 2.4.8 | 2.4.8 |
| fast-uri | npm | >= 3.0.0, < 3.1.9 | 3.1.9 |
| fast-uri | npm | >= 4.0.0, < 4.2.3 | 4.2.3 |
Run: grep -rn "reference: *suffix" node_modules-free source (search your own code for reference: suffix) and check the installed version with npm ls fast-uri
2.4.8, 3.1.9, or 4.2.3 depending on the major line in use, or stop using reference: suffix on untrusted inputEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
fast-uri's serialize(), normalize(), and resolve(), when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a path-noscheme reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. fast-uri's default serialization escapes that colon, but the suffix path does not.
For example, normalize('javascript:alert(1)', { reference: 'suffix' }) returns javascript:alert(1), which reparses as a live javascript: scheme; data: and vbscript: behave the same.
Applications that serialize or normalize a relative reference with reference: 'suffix' and then treat the result as a URI can turn inert input into a live javascript:, data:, or vbscript: URL (a cross-site scripting vector), and equal() can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default reference: 'suffix' option.
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.
Do not use the reference: 'suffix' option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.
This page as .md · .json · in your agent: get_signal("CVE-2026-110725")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.