CVE-2026-110725: 
JavaScript vulnerability analysis and mitigation

CVE-2026-110725 is a scheme injection vulnerability in fast-uri, a dependency-free RFC 3986 URI parser and serializer for Node.js. When serialize(), normalize(), or resolve() are called with the non-default reference: 'suffix' option on a reference that has no authority, the output may contain an unescaped bare colon in the first path segment — violating RFC 3986 section 3.3 and enabling the string to reparse as an absolute URI with a scheme. Affected versions include all releases before 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2. It was published on October 20, 2026, with a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Red Hat CVE).

The root cause is improper encoding or escaping of output (CWE-116) combined with improper resolution of path equivalence (CWE-41). By default, fast-uri correctly percent-encodes a colon in the first path segment of a relative reference; however, the suffix reference code path omits this escaping step. As a result, calling normalize('javascript:alert(1)', { reference: 'suffix' }) returns javascript:alert(1) verbatim — a string that any URI consumer will interpret as an absolute javascript: URI rather than a relative path. The same behavior applies to data: and vbscript: schemes, and the equal() function can incorrectly conflate a scheme-bearing URI with a relative reference (GitHub Advisory).

An application that uses the suffix reference option on untrusted input and subsequently treats the serialized or normalized result as a URI can inadvertently promote inert user-supplied strings into executable javascript:, data:, or vbscript: URLs, creating a cross-site scripting (XSS) vector. The integrity impact is limited — there is no confidentiality or availability impact — but successful exploitation could allow an attacker to execute arbitrary JavaScript in a victim's browser context, potentially leading to session hijacking, credential theft, or further client-side attacks. Exposure is strictly limited to applications that explicitly opt into the non-default reference: 'suffix' option (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Red Hat CVE). The EPSS score is 0.0, reflecting a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the target application to use the non-default reference: 'suffix' option and to pass attacker-controlled input through the affected functions, which significantly limits the attack surface.

1. Identify a target application: Find a Node.js application that uses fast-uri with the reference: 'suffix' option and passes the serialized/normalized URI output to a browser or URI consumer (e.g., as an href, src, or redirect target).
2. Craft a malicious input: Prepare a URI-like string with a dangerous scheme in the first path segment, such as javascript:alert(document.cookie) or data:text/html,<script>alert(1)</script>.
3. Submit the input: Supply the crafted string as untrusted input to the application at a point where it is processed by fast-uri's serialize(), normalize(), or resolve() with { reference: 'suffix' }.
4. Observe unescaped output: The function returns the string with the bare colon intact (e.g., javascript:alert(document.cookie)), which any downstream URI parser treats as an absolute URI with a javascript: scheme.
5. Trigger XSS: If the application renders the output as a link or redirect target in a browser, a user clicking the link executes the injected JavaScript in their browser context (GitHub Advisory).

Upgrade fast-uri to a patched version: 2.4.8 (for the 2.x branch), 3.1.9 (for the 3.x branch), or 4.2.3 (for the 4.x branch). If an immediate upgrade is not possible, avoid using the reference: 'suffix' option on any untrusted or user-controlled input. Alternatively, after calling the affected functions with the suffix option, percent-encode any colon character (%3A) in the first path segment of the result before treating it as a URI (GitHub Advisory).

The advisory was published by mcollina (a Fastify core maintainer) on the GitHub Security Advisory page on October 19, 2026, with a note that the report was submitted with AI assistance. Credit for finding the issue was given to UlisesGascon. No significant broader media coverage or notable community debate has been observed beyond the standard advisory channels (GitHub Advisory).