7.5
High
CVE-2026-6322 fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them…
Description
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| fast-uri 3.1 | earliest → < 3.1.2 | 3.1.2 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 1780600823 | earliest → < 1780600823 | 1780600823 |
| Red Hat Developer Hub 1.9 1781187342 | earliest → < 1781187342 | 1781187342 |
| Red Hat Discovery 2 1788206196 | earliest → < 1788206196 | 1788206196 |
| Red Hat Discovery 2 1782166952 | earliest → < 1782166952 | 1782166952 |
| Red Hat Quay 3.12 1781937357 | earliest → < 1781937357 | 1781937357 |
| Red Hat Quay 3.9 1781878070 | earliest → < 1781878070 | 1781878070 |
| Red Hat Satellite 6.18 1781032495 | earliest → < 1781032495 | 1781032495 |
| multicluster engine for Kubernetes 2.11 1780910888 | earliest → < 1780910888 | 1780910888 |
Show the 61 other branches Hide the 61 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Confidential Compute Attestation | Versions not published | |
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| Network Observability Operator | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| Cryostat 4 | Versions not published | |
| Red Hat AMQ Broker 7 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat OpenShift Container Platform 4.20 1783602326 | earliest → < 1783602326 | 1783602326 |
| Red Hat OpenShift Container Platform 4.21 1783502338 | earliest → < 1783502338 | 1783502338 |
| Red Hat OpenShift Container Platform 4.22 1782224099 | earliest → < 1782224099 | 1782224099 |
| Red Hat Quay 3.10 1782487717 | earliest → < 1782487717 | 1782487717 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Cluster Observability Operator 1.5.0 1782839494 | earliest → < 1782839494 | 1782839494 |
| Red Hat Ansible Automation Platform 2.6 1782721130 | earliest → < 1782721130 | 1782721130 |
| Red Hat Developer Hub 1.10 1783448184 | earliest → < 1783448184 | 1783448184 |
| Red Hat Edge Manager 1.0 1783502438 | earliest → < 1783502438 | 1783502438 |
| Red Hat OpenShift Container Platform 4.19 1786486822 | earliest → < 1786486822 | 1786486822 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Versions not published | |
| Red Hat Edge Manager 1.1 1784127736 | earliest → < 1784127736 | 1784127736 |
| Red Hat Quay 3.16 1783955846 | earliest → < 1783955846 | 1783955846 |
| multicluster engine for Kubernetes 2.11.0 1780910888 | earliest → < 1780910888 | 1780910888 |
| Red Hat OpenShift Container Platform 4.2 1783602326 | earliest → < 1783602326 | 1783602326 |
| Red Hat Quay 3.1 1782487717 | earliest → < 1782487717 | 1782487717 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Data Grid 8.6.2 | Versions not published | |
| Red Hat Ansible Automation Platform 2.7 1783919486 | earliest → < 1783919486 | 1783919486 |
| Red Hat Migration Toolkit 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Red Hat Migration Toolkit for Applications 8.2 1784109883 | earliest → < 1784109883 | 1784109883 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16.0 1780600823 | earliest → < 1780600823 | 1780600823 |
| Red Hat Quay 3.17 1786181981 | earliest → < 1786181981 | 1786181981 |
| Red Hat Migration Toolkit for Containers 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Red Hat OpenShift AI 3.4 1787121387 | earliest → < 1787121387 | 1787121387 |
| Red Hat OpenShift Container Platform 4.18 1787031447 | earliest → < 1787031447 | 1787031447 |
| Red Hat Openshift Data Foundation 4.18 1786706880 | earliest → < 1786706880 | 1786706880 |
| Red Hat Openshift Data Foundation 4.19 1786703143 | earliest → < 1786703143 | 1786703143 |
| Red Hat Openshift Data Foundation 4.2 1786629548 | earliest → < 1786629548 | 1786629548 |
| Red Hat Openshift Data Foundation 4.21 1786644362 | earliest → < 1786644362 | 1786644362 |
| Red Hat Openshift Data Foundation 4.22 1787061554 | earliest → < 1787061554 | 1787061554 |
| Red Hat Hardened Images 13.1 | earliest → < 13.1.3-0.3.hum1 | 13.1.3-0.3.hum1 |
| Cluster Observability Operator 1.5.2 1782839494 | earliest → < 1782839494 | 1782839494 |
| Red Hat Openshift Data Foundation 4.20 1786629548 | earliest → < 1786629548 | 1786629548 |
References
- github.com github.com
- cna.openjsf.org cna.openjsf.org
Timeline
- Published
- Last modified
Other CVEs of fast-uri
The 17 CVEs of fast-uri →
CVE-2026-110725
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
3.7
Low
CVE-2026-110306
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
6.1
Medium
CVE-2026-110180
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
4.8
Medium
CVE-2026-110095
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
3.7
Low