---
id: "CVE-2026-110725"
kind: "vulnerability"
aliases: ["CVE-2026-110725", "GHSA-333x-w4r6-6crp"]
title: "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references"
severity: "low"
cvss: 3.7
epss: 0.00254
exploited: false
status: "open"
category: "package"
products: [{"name": "fast-uri", "fixed": ["2.4.8"], "affected": "< 2.4.8", "ecosystem": "npm"}, {"name": "fast-uri", "fixed": ["3.1.9"], "affected": ">= 3.0.0, < 3.1.9", "ecosystem": "npm"}, {"name": "fast-uri", "fixed": ["4.2.3"], "affected": ">= 4.0.0, < 4.2.3", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-116", "cwe-41", "frontend", "javascript", "node", "npm", "package"]
not_affected_if: ["default-config", "no-suffix-option", "not-on-fast-uri-2.4.8-or-later"]
published_at: "2026-10-20T07:17:08+00:00"
first_seen_at: "2026-10-23T21:39:59+00:00"
updated_at: "2026-10-23T21:57:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-333x-w4r6-6crp", "first_seen_at": "2026-10-23T21:39:59+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110725", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fast-uri, an npm URI parsing library, fails to escape a colon in the first path segment when the non-default reference: 'suffix' option is used, so a relative reference like javascript:alert(1) reparses as a live javascript: URL. An attacker who controls the input that the application serializes or normalizes can produce a cross-site scripting vector.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:fast-uri affected < 2.4.8 fixed 2.4.8
- npm:fast-uri affected >= 3.0.0, < 3.1.9 fixed 3.1.9
- npm:fast-uri affected >= 4.0.0, < 4.2.3 fixed 4.2.3

## How to check

Run: grep -rn "reference: *'suffix'" node_modules-free source (search your own code for reference: 'suffix') and check the installed version with npm ls fast-uri

## Fix

Upgrade fast-uri to 2.4.8, 3.1.9, or 4.2.3 depending on the major line in use, or stop using reference: 'suffix' on untrusted input.
If suffix output is required, percent-encode a colon in the first path segment before treating the result as a URI.

## Timeline

- 2026-10-23T21:39:59+00:00 ghsa https://github.com/advisories/GHSA-333x-w4r6-6crp
- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110725

## From the sources

### Impact

`fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a `path-noscheme` reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. `fast-uri`'s default serialization escapes that colon, but the suffix path does not.

For example, `normalize('javascript:alert(1)', { reference: 'suffix' })` returns `javascript:alert(1)`, which reparses as a live `javascript:` scheme; `data:` and `vbscript:` behave the same.

Applications that serialize or normalize a relative reference with `reference: 'suffix'` and then treat the result as a URI can turn inert input into a live `javascript:`, `data:`, or `vbscript:` URL (a cross-site scripting vector), and `equal()` can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default `reference: 'suffix'` option.

### Patches

Upgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.

### Workarounds

Do not use the `reference: 'suffix'` option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_