What is GHSA-v39h-62p7-jpjc?

GHSA-v39h-62p7-jpjc is a security advisory published by GitHub Security Advisories with High severity. fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Which CVE IDs does GHSA-v39h-62p7-jpjc cover?

GHSA-v39h-62p7-jpjc covers the following CVE IDs: CVE-2026-6322. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v39h-62p7-jpjc?

GHSA-v39h-62p7-jpjc has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-v39h-62p7-jpjc?

GHSA-v39h-62p7-jpjc affects 2 products, including: npm/fast-uri:\u003e= 3.0.0, \u003c= 3.1.1; npm/fast-uri:\u003c= 2.4.0.

GHSA-v39h-62p7-jpjcHighCVSS 7.5

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Vendor

GitHub Security Advisories

Published

May 8, 2026

Last Modified

August 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-6322 →

📋 Description

Impact

fast-uri v3.1.1 and earlier decodes percent-encoded authority delimiters (%40 as @, %3A as :) inside the host component and serializes them back as raw characters. This changes the URI structure, turning a hostname into userinfo plus a different host.

For example, http://trusted.com%40evil.com/ normalizes to http://[email protected]/, which reparses as host evil.com with userinfo trusted.com.

Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the original URL appeared to contain.

Patches

Upgrade to fast-uri >= 3.1.2, or if you are in the v2.x release line, v2.4.1

Workarounds

None. Upgrade to the patched version.

🎯 Affected products2

npm/fast-uri:>= 3.0.0, <= 3.1.1
npm/fast-uri:<= 2.4.0