CVE-2026-6322: Fast uri Remote Code Execution Vulnerability

Q: What is CVE-2026-6322?

CVE-2026-6322 is a security vulnerability in Fast uri involving fast-uri vulnerable to host confusion via percent-encoded authority delimiters under CWE-140: Improper Neutralization of Delimiters.

Q: Which Fast uri versions are affected?

Affected versions include releases prior to 3.1.2, 2.4.1 across affected packages: fast-uri.

Q: What version fixes CVE-2026-6322?

Upgrading to 3.1.2, 2.4.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is fast-uri affected?

Yes, fast-uri is affected in releases prior to 3.1.2, 2.4.1. Upgrade your dependency to 3.1.2, 2.4.1 or later.

Q: What is the CVSS score of CVE-2026-6322?

CVE-2026-6322 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Q: What CWE is associated with CVE-2026-6322?

CVE-2026-6322 is classified under CWE-140: Improper Neutralization of Delimiters (The product does not neutralize or incorrectly neutralizes delimiters.).

Q: How can I check npm dependencies for CVE-2026-6322?

Run the dependency tree command: 'npm ls fast-uri'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-v39h-62p7-jpjc

CVSS 7.5

CWE-140 CWE-436

Published 2026-05-08

Advisory Summary

CVE-2026-6322 is a HIGH (CVSS 7.5) remote code execution vulnerability (CWE-140: Improper Neutralization of Delimiters) affecting Fast uri libraries in the npm ecosystem. The issue involves fast-uri vulnerable to host confusion via percent-encoded authority delimiters. Remediation is available by upgrading affected packages to version 3.1.2, 2.4.1.

CVE-2026-6322 at a Glance

CVE Identifier CVE-2026-6322

GHSA Identifier GHSA-v39h-62p7-jpjc

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-140: Improper Neutralization of Delimiters

Affected Product Fast uri

Package Ecosystem npm

Published Date 2026-05-08

Last Updated 2026-09-01

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity High (I:H)

Availability None (A:N)

How to Fix CVE-2026-6322

To remediate this vulnerability, upgrade all affected Fast uri dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

fast-uri fixed: 3.1.2

npm install fast-uri@3.1.2

fast-uri fixed: 2.4.1

npm install fast-uri@2.4.1

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

npm ls fast-uri

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-6322, inspect your project dependencies using npm:

npm ls fast-uri

Analyze the terminal output to locate any version of Fast uri in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.1.2), your application is affected.

Note: The npm ls fast-uri command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-140: Improper Neutralization of Delimiters, where the product does not neutralize or incorrectly neutralizes delimiters. In Fast uri, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact `fast-uri` v3.1.1 and earlier decodes percent-encoded authority delimiters (`%40` as `@`, `%3A` as `:`) inside the host component and serializes them back as raw characters. This changes the URI structure, turning a hostname into userinfo plus a different host. For example, `http://trusted.com%40evil.com/` normalizes to `http://trusted.com@evil.com/`, which reparses as host `evil.com` with userinfo `trusted.com`. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the original URL appeared to contain. ### Patches Upgrade to `fast-uri` >= 3.1.2, or if you are in the v2.x release line, v2.4.1 ### Workarounds None. Upgrade to the patched version.

CVE-2026-6322 Affected Fast uri Versions

2 component(s)

Fixed Versions:

3.1.22.4.1

Product / Package	Ecosystem	Affected Versions	Fixed Version
fast-uri npm/fast-uri	npm	≥ 3.0.0 < 3.1.2	3.1.2
fast-uri npm/fast-uri	npm	< 2.4.1	2.4.1

References

access.redhat.com/errata/rhsa-2026:61... WEB

https://access.redhat.com/errata/RHSA-2026:61783

Fast uri Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2026-6322

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2466684

Fast uri Security Information SECURITY

https://cna.openjsf.org/security-advisories.html

Fast uri Source Repository REPOSITORY

https://github.com/fastify/fast-uri

Fast uri Release RELEASE

https://github.com/fastify/fast-uri/releases/tag/v2.4.1

Fast uri Release RELEASE

https://github.com/fastify/fast-uri/releases/tag/v3.1.2

Fast uri Security Information SECURITY

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6322.json

access.redhat.com/errata/rhsa-2026:25... WEB

https://access.redhat.com/errata/RHSA-2026:25271

access.redhat.com/errata/rhsa-2026:25... WEB

https://access.redhat.com/errata/RHSA-2026:25273

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26225

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26234

access.redhat.com/errata/rhsa-2026:28... WEB

https://access.redhat.com/errata/RHSA-2026:28571

access.redhat.com/errata/rhsa-2026:29... WEB

https://access.redhat.com/errata/RHSA-2026:29197

access.redhat.com/errata/rhsa-2026:29... WEB

https://access.redhat.com/errata/RHSA-2026:29795

access.redhat.com/errata/rhsa-2026:29... WEB

https://access.redhat.com/errata/RHSA-2026:29796

GitHub Advisory / Wiki ADVISORY

https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc

NVD — CVE-2026-6322 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-6322

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41928

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41951

access.redhat.com/errata/rhsa-2026:42... WEB

https://access.redhat.com/errata/RHSA-2026:42078

access.redhat.com/errata/rhsa-2026:42... WEB

https://access.redhat.com/errata/RHSA-2026:42142

access.redhat.com/errata/rhsa-2026:43... WEB

https://access.redhat.com/errata/RHSA-2026:43038

access.redhat.com/errata/rhsa-2026:54... WEB

https://access.redhat.com/errata/RHSA-2026:54395

access.redhat.com/errata/rhsa-2026:54... WEB

https://access.redhat.com/errata/RHSA-2026:54555

access.redhat.com/errata/rhsa-2026:56... WEB

https://access.redhat.com/errata/RHSA-2026:56366

access.redhat.com/errata/rhsa-2026:56... WEB

https://access.redhat.com/errata/RHSA-2026:56431

access.redhat.com/errata/rhsa-2026:56... WEB

https://access.redhat.com/errata/RHSA-2026:56928

access.redhat.com/errata/rhsa-2026:56... WEB

https://access.redhat.com/errata/RHSA-2026:56968

access.redhat.com/errata/rhsa-2026:57... WEB

https://access.redhat.com/errata/RHSA-2026:57013

access.redhat.com/errata/rhsa-2026:57... WEB

https://access.redhat.com/errata/RHSA-2026:57487

access.redhat.com/errata/rhsa-2026:60... WEB

https://access.redhat.com/errata/RHSA-2026:60520

access.redhat.com/errata/rhsa-2026:60... WEB

https://access.redhat.com/errata/RHSA-2026:60855

access.redhat.com/errata/rhsa-2026:29... WEB

https://access.redhat.com/errata/RHSA-2026:29800

access.redhat.com/errata/rhsa-2026:29... WEB

https://access.redhat.com/errata/RHSA-2026:29834

access.redhat.com/errata/rhsa-2026:30... WEB

https://access.redhat.com/errata/RHSA-2026:30076

access.redhat.com/errata/rhsa-2026:33... WEB

https://access.redhat.com/errata/RHSA-2026:33683

access.redhat.com/errata/rhsa-2026:34... WEB

https://access.redhat.com/errata/RHSA-2026:34160

access.redhat.com/errata/rhsa-2026:34... WEB

https://access.redhat.com/errata/RHSA-2026:34342

access.redhat.com/errata/rhsa-2026:34... WEB

https://access.redhat.com/errata/RHSA-2026:34374

access.redhat.com/errata/rhsa-2026:34... WEB

https://access.redhat.com/errata/RHSA-2026:34766

access.redhat.com/errata/rhsa-2026:34... WEB

https://access.redhat.com/errata/RHSA-2026:34770

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36651

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36754

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37186

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37385

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37628

access.redhat.com/errata/rhsa-2026:40... WEB

https://access.redhat.com/errata/RHSA-2026:40118

access.redhat.com/errata/rhsa-2026:40... WEB

https://access.redhat.com/errata/RHSA-2026:40945

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41066

Frequently Asked Questions

What is CVE-2026-6322?

CVE-2026-6322 is a security vulnerability in Fast uri involving fast-uri vulnerable to host confusion via percent-encoded authority delimiters under CWE-140: Improper Neutralization of Delimiters.

Which Fast uri versions are affected?

Affected versions include releases prior to 3.1.2, 2.4.1 across affected packages: fast-uri.

What version fixes CVE-2026-6322?

Upgrading to 3.1.2, 2.4.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Is fast-uri affected?

Yes, fast-uri is affected in releases prior to 3.1.2, 2.4.1. Upgrade your dependency to 3.1.2, 2.4.1 or later.

What is the CVSS score of CVE-2026-6322?

CVE-2026-6322 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

What CWE is associated with CVE-2026-6322?

CVE-2026-6322 is classified under CWE-140: Improper Neutralization of Delimiters (The product does not neutralize or incorrectly neutralizes delimiters.).

How can I check npm dependencies for CVE-2026-6322?

Run the dependency tree command: 'npm ls fast-uri'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v39h-62p7-jpjc",
  "modified" : "2026-09-01T15:30:39Z",
  "published" : "2026-05-08T19:13:01Z",
  "aliases" : [ "CVE-2026-6322" ],
  "summary" : "fast-uri vulnerable to host confusion via percent-encoded authority delimiters",
  "details" : "### Impact\n\n`fast-uri` v3.1.1 and earlier decodes percent-encoded authority delimiters (`%40` as `@`, `%3A` as `:`) inside the host component and serializes them back as raw characters. This changes the URI structure, turning a hostname into userinfo plus a different host.\n\nFor example, `http://trusted.com%40evil.com/` normalizes to `http://trusted.com@evil.com/`, which reparses as host `evil.com` with userinfo `trusted.com`.\n\nApplications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the original URL appeared to contain.\n\n### Patches\n\nUpgrade to `fast-uri` >= 3.1.2, or if you are in the v2.x release line, v2.4.1\n\n### Workarounds\n\nNone. Upgrade to the patched version.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "fast-uri"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.1.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.1.1"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "fast-uri"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.4.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.4.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-6322"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41928"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41951"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:42078"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:42142"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:43038"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:54395"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:54555"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:56366"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:56431"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:56928"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:56968"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:57013"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:57487"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:60520"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:60855"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:61783"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-6322"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2466684"
  }, {
    "type" : "WEB",
    "url" : "https://cna.openjsf.org/security-advisories.html"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/fastify/fast-uri"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fast-uri/releases/tag/v2.4.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fast-uri/releases/tag/v3.1.2"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6322.json"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:25271"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:25273"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26225"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26234"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:28571"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:29197"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:29795"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:29796"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:29800"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:29834"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:30076"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:33683"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:34160"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:34342"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:34374"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:34766"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:34770"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36651"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36754"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37186"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37385"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37628"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:40118"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:40945"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41066"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-140", "CWE-436" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-08T19:13:01Z",
    "nvd_published_at" : "2026-05-05T11:16:33Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity High (I:H)

Availability None (A:N)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Advisory Metadata

Source ID: GHSA-v39h-62p7-jpjc
Schema Version: 1.4.0
Published: 2026-05-08 19:13
Last Modified: 2026-09-01 15:30
Database Record File: advisories/github-reviewed/2026/05/GHSA-v39h-62p7-jpjc/GHSA-v39h-62p7-jpjc.json