CVE-2026-6322General(openjsf / fast-uri)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch openjsf fast-uri systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

openjsf CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-436CWE-140

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

fast-uri

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 1d ago at 3 mentions (2026-05-05); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

openjsf

Products

fast-uri

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

General

250.0%

Patch

125.0%

Disclosure

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-05	3	General2Patch1
2026-05-08	1	Disclosure1

Full discourse4 posts

CVE@CVEnew160d
General
CVE-2026-6322 fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that… https://www.cve.org/CVERecord?id=CVE-2026-6322
Post summary
The post briefly explains how CVE‑2026‑6322 causes the fast‑uri library to mishandle percent‑encoded authority delimiters in host components, but it provides no proof of concept, exploit code, patch, or evidence of active exploitation.
00020274
57.7K followersView on X
Ulises Gascón@kom_256160d
Patch
🚨 High-severity security fix in fast-uri@3.1.2 just released! Patches CVE-2026-6322 — fast-uri vulnerable to host confusion via percent-encoded authority delimiters https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc
Post summary
A high‑severity vulnerability (CVE‑2026‑6322) in fast-uri was patched in version 3.1.2, addressing host confusion due to percent‑encoded authority delimiters.
00011106
5.6K followersView on X
DailyCVE@dailycve156d
Disclosure
🔴 fast-uri, Host Confusion, #CVE-2026-6322 (High) https://dailycve.com/fast-uri-host-confusion-cve-2026-6322-high/
Post summary
The post announces the fast-uri Host Confusion vulnerability (CVE-2026-6322) with a high severity rating and provides a link for detailed information.
0000029
198 followersView on X
Infoflowcloud@infoflowcloud160d
General
🚨*CVE* CVE-2026-6322 fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that… https://www.cve.org/CVERecord?id=CVE-2026-6322 ----- Traducción: CVE-2026-6322 fas… http://infoflow.cloud`
Post summary
The text briefly describes the technical flaw in fast-uri and provides a link to the CVE record, without mentioning exploitation or mitigation.
0000037
75 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openjsf	fast-uri	-	node.js	-

Explore more

Back to dashboard openjsf CVEs fast-uri vulnerabilities

What researchers are saying

CVE-2026-6322

CVE@CVEnewGeneral

The post briefly explains how CVE‑2026‑6322 causes the fast‑uri library to mishandle percent‑encoded authority delimiters in host components, but it provides no proof of concept, exploit code, patch, or evidence of active exploitation.

Ulises Gascón@kom_256Patch

A high‑severity vulnerability (CVE‑2026‑6322) in fast-uri was patched in version 3.1.2, addressing host confusion due to percent‑encoded authority delimiters.

DailyCVE@dailycveDisclosure

The post announces the fast-uri Host Confusion vulnerability (CVE-2026-6322) with a high severity rating and provides a link for detailed information.

Infoflowcloud@infoflowcloudGeneral

The text briefly describes the technical flaw in fast-uri and provides a link to the CVE record, without mentioning exploitation or mitigation.