CVE-2026-110306: 
JavaScript vulnerability analysis and mitigation

CVE-2026-110306 is a URI scheme spoofing vulnerability in the fast-uri Node.js library that enables stored or reflected cross-site scripting (XSS) attacks. The flaw affects fast-uri versions before 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2. It was published on October 20, 2026, with the GitHub Security Advisory authored by maintainer mcollina. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an incorrect validation order (CWE-180) combined with an encoding error (CWE-172): fast-uri applies the legacy JavaScript unescape() function to percent-decode the URI scheme component before validating it, violating RFC 3986 §3.1 which explicitly prohibits percent-encoding in schemes. This means an input like %6Aavascript:alert(1) is decoded to javascript:alert(1) and emitted as a live, executable scheme. Additionally, the equal() comparison function treats percent-encoded and plain schemes as equivalent, allowing attackers to bypass equality-based scheme allowlists. Concrete examples include: normalize('%6Aavascript:alert(1)') returning javascript:alert(1), and equal('%68ttp://a/', 'http://a/') returning true (GitHub Advisory).

An unauthenticated attacker who can supply URI input to an application using fast-uri can craft a percent-encoded scheme (e.g., %6Aavascript:, %64ata:, or vbscript: variants) that passes raw-input scheme screening but is normalized into an executable URL. When the application stores or renders the normalized result in a browser, this produces stored or reflected XSS, enabling session hijacking, credential theft, or malicious script execution in the victim's browser context. Availability is not impacted, but both confidentiality and integrity are affected at a low-to-moderate level with a changed scope (GitHub Advisory, Red Hat CVE).

As of the disclosure date, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is reported at 0.0, indicating very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a target application: Find a web application that uses a vulnerable version of fast-uri (< 2.4.8, 3.0.0–3.1.8, or 4.0.0–4.2.2) to parse, normalize, or resolve user-supplied URIs, and that screens dangerous schemes on the raw input string before storing or rendering the result.
2. Craft a percent-encoded malicious URI: Construct a URI where the dangerous scheme is percent-encoded so it passes raw-input validation, e.g., %6Aavascript:alert(document.cookie) (where %6A decodes to j) or using the %uXXXX form: %u006Aavascript:alert(1).
3. Submit the payload: Provide the crafted URI as input to the application (e.g., via a URL field, redirect parameter, or link submission form). The raw input passes the application's scheme blocklist check because it does not literally contain javascript:.
4. Trigger normalization: The application calls fast-uri's normalize() or resolve() function, which internally calls unescape() on the scheme before validation, converting the encoded scheme to javascript:alert(document.cookie) and emitting it as a live scheme.
5. Achieve XSS: The normalized URI is stored in the database or reflected in the HTTP response. When a victim's browser renders the link and clicks it, the javascript: URL executes, delivering the XSS payload and potentially stealing session tokens or performing actions on behalf of the victim (GitHub Advisory).

• Network: HTTP requests containing percent-encoded scheme components in URI parameters (e.g., %6Aavascript:, %64ata:, %u006A) submitted to application endpoints that accept URL input.
• Logs: Application or web server access logs showing inputs with % characters in the scheme portion of submitted URIs (before the first :); repeated submissions with variations of encoded javascript, data, or vbscript strings.
• Application Behavior: Stored links or redirects in the application database containing javascript:, data:, or vbscript: URIs that were not present in raw user input — indicating normalization has occurred on encoded input.
• Browser/Client Side: Unexpected JavaScript execution triggered by clicking links within the application; browser console errors or alerts originating from javascript: scheme URLs on trusted domains.

Upgrade fast-uri to one of the patched versions: 2.4.8, 3.1.9, or 4.2.3 (or any later release). If an immediate upgrade is not possible, apply one of two workarounds: (1) reject any URI input whose scheme component (the substring before the first :, /, ?, or #) contains a % character; or (2) validate parse(input).scheme against an allowlist after normalization and use the parsed result rather than the raw input string for all downstream operations (GitHub Advisory).

The advisory was published by fast-uri maintainer mcollina on GitHub, with UlisesGascon credited as a remediation reviewer (GitHub Advisory). Red Hat tracked the issue via Bugzilla (Bug #2556005) and published a CVE advisory page, indicating downstream awareness in enterprise Linux distributions (Red Hat CVE). No significant broader media coverage or notable social media commentary has been identified at this time.