What is the CVSS score of CVE-2026-6322?

CVE-2026-6322 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-6322?

Yes, a public proof-of-concept exploit is available for CVE-2026-6322. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6322?

Within 24 hours: Identify all applications and services using fast-uri library and document current versions in use. Within 7 days: Upgrade fast-uri to version 3.1.2 or later across all production systems; verify through dependency scanning tools (npm audit, Snyk, etc.). Within 30 days: Conduct security review of URL validation logic in applications that relied on fast-uri for allowlist or redirect enforcement; implement compensating controls if legacy systems cannot be upgraded immediately.

fast-uri CVE-2026-6322

Q: Which versions of fast-uri are affected by CVE-2026-6322?

CVE-2026-6322 affects the fast-uri JavaScript library and enables attackers to bypass URL validation controls by exploiting improper handling of percent-encoded characters, allowing redirect and…. A patch is available.

EUVD-2026-27248 HIGH

Interpretation Conflict (CWE-436)

2026-05-05 openjs

GHSA-v39h-62p7-jpjc

Information Disclosure Fast Uri

7.5

CVSS 3.1 · Vendor: openjs

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft URL with encoded @ delimiter
Delivery

Submit to vulnerable endpoint
Exploit

Trigger fast-uri normalize()
Execution

Bypass allowlist validation
Impact

Redirect victim to attacker domain

Vulnerability Assessment

Weakness	CWE CWE-436 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V4 - API and Web Service Interpretation consistency
Exploitation Conditions	Exploitation requires the target application to: (1) accept untrusted URLs from user input (query parameters, POST data, JSON payloads), (2) pass those URLs through fast-uri's normalize() function, and (3) perform security decisions (allowlist validation, redirect approval, SSRF prevention, outbound request routing) on the normalized output rather than the raw input. The vulnerability does NOT affect applications that validate URLs before normalization, applications that parse but don't normalize URLs, or applications using fast-uri only for non-security-critical URL manipulation. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no special network conditions, authentication, or user interaction required once a vulnerable application pattern exists. Limiting factors: requires developer to implement the specific vulnerable pattern of normalize-then-validate, and requires the application to handle user-controlled URLs in security-sensitive contexts. Applications using alternative validation logic or different parsing libraries are not affected.
Impact	Real-world risk is HIGH for applications using fast-uri in security-critical URL validation flows. CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N indicates trivial remote exploitation requiring no authentication or user interaction, and AC:L means exploitation is straightforward once the vulnerable pattern is identified. The High Integrity impact (I:H) reflects the ability to bypass security controls entirely. However, exploitability depends entirely on application context - the vulnerability only manifests when developers use fast-uri's normalize() output for allowlist validation, redirect target checking, or SSRF prevention. Applications that validate raw input before normalization, or that don't perform host-based security checks, are not affected. EPSS score unavailable but expected to be moderate given this is a logic flaw requiring specific application integration patterns. Not in CISA KEV, indicating no confirmed widespread exploitation, though the public GitHub Security Advisory (GHSA-v39h-62p7-jpjc) provides full technical details that enable exploitation. SSVC assessment: exploitation status = POC (advisory includes demonstration), automatable = no (requires vulnerable integration pattern), technical impact = partial (integrity bypass in specific contexts). Priority depends on whether your application uses fast-uri for security-sensitive URL validation.
Exploit ScenarioDerived	An attacker targets a web application that uses fast-uri to validate redirect URLs against an allowlist of trusted domains (e.g., 'trusted.com'). The application accepts a redirect parameter like 'http://trusted.com%40attacker.com/steal-session' which appears to target the trusted domain. The application passes this URL through fast-uri's normalize() function, which decodes %40 to '@' and re-emits it, producing 'http://trusted.com@attacker.com/steal-session'. The allowlist check naively matches 'trusted.com' in the normalized string and approves the redirect. The user's browser interprets the '@' as a userinfo separator per RFC 3986, connecting to 'attacker.com' instead, where the attacker captures session tokens or credentials. Public exploit code exists in the GitHub Security Advisory demonstrating the parsing behavior.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 05, 2026

Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. The normalize() function improperly decodes percent-encoded at-signs (%40) in hostnames, then re-serializes them as raw userinfo delimiters, causing URLs like 'http://trusted.com%40evil.com' to resolve to 'evil.com' instead of 'trusted.com'. Applications using fast-uri to validate URLs against allowlists or for redirect validation can be tricked into connecting to attacker-controlled domains. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation with no authentication. EPSS data not available; no confirmed active exploitation (not in CISA KEV). Vendor patch released in version 3.1.2.

RemediationAI

Update fast-uri to version 3.1.2 or later, which correctly handles percent-encoded authority delimiters without re-interpreting them as structural characters. For npm-based projects, run 'npm update fast-uri' or update package.json to specify '"fast-uri": "^3.1.2"' and reinstall dependencies. Vendor advisory at https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc confirms the fix. If immediate upgrade is not feasible, implement these compensating controls: (1) perform allowlist validation on raw URLs BEFORE normalization to prevent interpretation differences, (2) reject any URLs containing percent-encoded characters in the authority component (%40, %2F, %3A, %23, %3F) before passing to fast-uri, or (3) use alternative URL parsing libraries like Node.js native URL API for security-critical validation. Trade-off: Pre-normalization validation may reject some legitimate edge-case URLs but prevents parser confusion attacks. Do NOT rely solely on post-normalization validation for security decisions when using versions <=3.1.1.

Affected VersionsENISA

fast-uri 0 <3.1.2

Affected Packages

npm fast-uri fix: 2.4.1, 3.1.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability affects the fast-uri JavaScript library (npm package), specifically the normalize() function used for URL canonicalization. The root cause is CWE-436 (Interpretation Conflict), where the same input is processed differently by sequential validation stages. RFC 3986 defines '@' as the userinfo-host separator in URIs (userinfo@host). When an encoded '@' (%40) appears within what looks like a hostname, fast-uri's normalization incorrectly decodes it during parsing but then re-emits it as a literal '@' during serialization, transforming the URI structure. The CPE identifier cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:* confirms this is a library-level vulnerability affecting all consuming applications. This is a parser differential attack similar to SSRF and open redirect vulnerabilities, where normalization changes the semantic meaning of user-supplied URLs in security-sensitive contexts.

Know when Fast Uri gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (openjs) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 05, 2026 - 12:01 EUVD

DescriptionCVE.org

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

Executive ViewAI

Why It Matters

CVE-2026-6322 affects the fast-uri JavaScript library and enables attackers to bypass URL validation controls by exploiting improper handling of percent-encoded characters, allowing redirect and allowlist bypasses without authentication. Organizations using fast-uri for URL validation, domain allowlisting, or redirect protection face immediate risk of being directed to attacker-controlled domains. This requires urgent inventory and patching of all applications consuming this library.

Business Impact: High

Compensating Controls

Vendor-released patch: fast-uri version 3.1.2. If immediate patching is not feasible: (1) Implement network-level hostname validation independent of fast-uri; (2) Use URL parsing libraries with established security track records in parallel; (3) Add manual code review of all redirect destinations before processing; (4) Enforce strict Content Security Policy headers to limit redirect targets; (5) Monitor URL patterns in logs for %40-encoded at-signs as a detection signal.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Fast Uri

View all

CVE-2026-75931 HIGH This Week POC

7.5 Aug 24

Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste

CVE-2026-75975 HIGH This Week POC

7.5 Aug 24

Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify eco

CVE-2026-75899 HIGH This Week POC

7.5 Aug 24

Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and

CVE-2026-13676 HIGH This Week POC

7.5 Jun 29

Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remot

CVE-2026-76172 HIGH This Week POC

7.5 Aug 24

Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ

CVE-2026-84292 HIGH This Week POC

7.5 Sep 02

URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the

CVE-2026-18446 HIGH This Week POC

7.5 Jul 31

Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to

CVE-2026-6321 HIGH This Week POC

7.5 May 04

Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls

CVE-2026-84394 HIGH This Week POC

7.5 Sep 02

Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy ro

CVE-2026-16221 HIGH This Week POC

7.5 Jul 19

Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2

CVE-2026-86818 MEDIUM This Month POC

4.8 Sep 15

The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the res

CVE-2026-86472 MEDIUM This Month POC

4.8 Sep 15

Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects

Same weakness CWE-436 – Interpretation Conflict

View all

CVE-2026-63030 CRITICAL POC

9.8

CVE-2024-24754 CRITICAL POC

9.8

CVE-2023-24813 CRITICAL POC

9.8

CVE-2019-19589 CRITICAL POC

9.8

CVE-2025-12816 HIGH POC

8.6

CVE-2026-67201 HIGH POC

7.7

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Micro 5.3	Affected
SUSE Linux Enterprise Micro 5.3	Affected
SUSE Linux Enterprise Micro 5.3	Affected
SUSE Linux Enterprise Micro 5.3	Affected
SUSE Linux Enterprise Micro 5.4	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back