fast-uri EUVD-2026-104807

Exploitation requires that the application explicitly set the non-default reference: suffix option when calling fast-uri's serialize(), normalize(), or resolve() on a relative reference that has no authority component, and then treat the returned string as a live URL (e.g., render it in HTML or follow it). The default configuration is not affected. Limiting factors: the suffix option is non-default and developer-chosen (reflected as AC:H), the input must be a relative reference with a bare colon in its first path segment, and realizing the XSS payload further depends on the application rendering the unescaped output in a browser context. Documented workarounds are to avoid the suffix option on untrusted input or to percent-encode a colon in the first path segment before using the result as a URI.

This is a genuinely low-priority issue that the CVSS base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects, and multiple signals agree rather than conflict. The vector is network-reachable and unauthenticated (PR:N), but high complexity (AC:H) is well-justified because exploitation depends entirely on the application opting into the non-default reference: suffix serialization option against a reference lacking an authority component - a narrow, developer-chosen code path. Impact is limited to Integrity (I:L) with no confidentiality or availability effect, consistent with an XSS/URL-confusion primitive rather than code execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; there is no SSVC decision data to cross-reference. The one elevating factor is prevalence: fast-uri is a heavily used transitive dependency in the Node.js ecosystem (Fastify, ajv), so the library is everywhere even though the vulnerable usage pattern is rare. Net assessment: real but low-urgency - a correctness/defense-in-depth fix, not an emergency patch, unless an application is known to pass untrusted input through serialize()/normalize()/resolve() with the suffix option.

An application uses fast-uri's non-default reference: suffix option to normalize or serialize a user-supplied relative reference, then renders or follows the result as a URL. An attacker submits a relative reference whose first path segment contains a bare colon; fast-uri emits it unescaped, so the output reparses as an absolute URI, letting the attacker smuggle a javascript:, data:, or vbscript: scheme to achieve cross-site scripting. No public exploit code was identified in the provided data, and high attack complexity (AC:H) reflects the required non-default configuration.