7.5
Élevée
CVE-2026-6322 fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them…
Description
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| fast-uri 3.1 | premières → < 3.1.2 | 3.1.2 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 1780600823 | premières → < 1780600823 | 1780600823 |
| Red Hat Developer Hub 1.9 1781187342 | premières → < 1781187342 | 1781187342 |
| Red Hat Discovery 2 1788206196 | premières → < 1788206196 | 1788206196 |
| Red Hat Discovery 2 1782166952 | premières → < 1782166952 | 1782166952 |
| Red Hat Quay 3.12 1781937357 | premières → < 1781937357 | 1781937357 |
| Red Hat Quay 3.9 1781878070 | premières → < 1781878070 | 1781878070 |
| Red Hat Satellite 6.18 1781032495 | premières → < 1781032495 | 1781032495 |
| multicluster engine for Kubernetes 2.11 1780910888 | premières → < 1780910888 | 1780910888 |
Afficher les 61 autres branches Masquer les 61 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Confidential Compute Attestation | Versions non publiées | |
| Migration Toolkit for Applications 8 | Versions non publiées | |
| Migration Toolkit for Containers | Versions non publiées | |
| Network Observability Operator | Versions non publiées | |
| OpenShift Lightspeed | Versions non publiées | |
| OpenShift Pipelines | Versions non publiées | |
| OpenShift Serverless | Versions non publiées | |
| Red Hat Ansible Automation Platform 2 | Versions non publiées | |
| Red Hat Build of Podman Desktop | Versions non publiées | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions non publiées | |
| Red Hat Data Grid 8 | Versions non publiées | |
| Red Hat Edge Manager 1 | Versions non publiées | |
| Red Hat Enterprise Linux 10 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions non publiées | |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées | |
| Red Hat OpenShift Container Platform 4 | Versions non publiées | |
| Red Hat Openshift Data Foundation 4 | Versions non publiées | |
| Red Hat OpenShift Dev Spaces | Versions non publiées | |
| Red Hat OpenShift Virtualization 4 | Versions non publiées | |
| Red Hat Quay 3 | Versions non publiées | |
| Red Hat Satellite 6 | Versions non publiées | |
| Self-service automation portal 2 | Versions non publiées | |
| Cryostat 4 | Versions non publiées | |
| Red Hat AMQ Broker 7 | Versions non publiées | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.20 1783602326 | premières → < 1783602326 | 1783602326 |
| Red Hat OpenShift Container Platform 4.21 1783502338 | premières → < 1783502338 | 1783502338 |
| Red Hat OpenShift Container Platform 4.22 1782224099 | premières → < 1782224099 | 1782224099 |
| Red Hat Quay 3.10 1782487717 | premières → < 1782487717 | 1782487717 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions non publiées | |
| Cluster Observability Operator 1.5.0 1782839494 | premières → < 1782839494 | 1782839494 |
| Red Hat Ansible Automation Platform 2.6 1782721130 | premières → < 1782721130 | 1782721130 |
| Red Hat Developer Hub 1.10 1783448184 | premières → < 1783448184 | 1783448184 |
| Red Hat Edge Manager 1.0 1783502438 | premières → < 1783502438 | 1783502438 |
| Red Hat OpenShift Container Platform 4.19 1786486822 | premières → < 1786486822 | 1786486822 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Versions non publiées | |
| Red Hat Edge Manager 1.1 1784127736 | premières → < 1784127736 | 1784127736 |
| Red Hat Quay 3.16 1783955846 | premières → < 1783955846 | 1783955846 |
| multicluster engine for Kubernetes 2.11.0 1780910888 | premières → < 1780910888 | 1780910888 |
| Red Hat OpenShift Container Platform 4.2 1783602326 | premières → < 1783602326 | 1783602326 |
| Red Hat Quay 3.1 1782487717 | premières → < 1782487717 | 1782487717 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions non publiées | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions non publiées | |
| Red Hat Data Grid 8.6.2 | Versions non publiées | |
| Red Hat Ansible Automation Platform 2.7 1783919486 | premières → < 1783919486 | 1783919486 |
| Red Hat Migration Toolkit 1.8 1783690532 | premières → < 1783690532 | 1783690532 |
| Red Hat Migration Toolkit for Applications 8.2 1784109883 | premières → < 1784109883 | 1784109883 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16.0 1780600823 | premières → < 1780600823 | 1780600823 |
| Red Hat Quay 3.17 1786181981 | premières → < 1786181981 | 1786181981 |
| Red Hat Migration Toolkit for Containers 1.8 1783690532 | premières → < 1783690532 | 1783690532 |
| Red Hat OpenShift AI 3.4 1787121387 | premières → < 1787121387 | 1787121387 |
| Red Hat OpenShift Container Platform 4.18 1787031447 | premières → < 1787031447 | 1787031447 |
| Red Hat Openshift Data Foundation 4.18 1786706880 | premières → < 1786706880 | 1786706880 |
| Red Hat Openshift Data Foundation 4.19 1786703143 | premières → < 1786703143 | 1786703143 |
| Red Hat Openshift Data Foundation 4.2 1786629548 | premières → < 1786629548 | 1786629548 |
| Red Hat Openshift Data Foundation 4.21 1786644362 | premières → < 1786644362 | 1786644362 |
| Red Hat Openshift Data Foundation 4.22 1787061554 | premières → < 1787061554 | 1787061554 |
| Red Hat Hardened Images 13.1 | premières → < 13.1.3-0.3.hum1 | 13.1.3-0.3.hum1 |
| Cluster Observability Operator 1.5.2 1782839494 | premières → < 1782839494 | 1782839494 |
| Red Hat Openshift Data Foundation 4.20 1786629548 | premières → < 1786629548 | 1786629548 |
Références
- github.com github.com
- cna.openjsf.org cna.openjsf.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de fast-uri
Les 17 CVE de fast-uri →
CVE-2026-110725
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
3.7
Faible
CVE-2026-110306
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
6.1
Moyenne
CVE-2026-110180
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
4.8
Moyenne
CVE-2026-110095
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
3.7
Faible