Fast Uri EUVD-2026-70282

Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remot

Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to

Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls

Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T

Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste

Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify eco

Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and

Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ

URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the

Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2

The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the res

We need answer JSON only. Need produce fields. Need be careful. Let's parse. CVE-2026-86472 fast-uri. Description: fast