Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-6322 Details

Description

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: redhat-SADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/errata/RHSA-2026:25271 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:25273 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:26225 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:26234 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:28571 redhat-SADP

see all 46 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-140Improper Neutralization of Delimitersredhat-SADP
CWE-436Interpretation Conflictopenjs

Affected Products

ProductVersions
openjsf fast-uri
< 3.1.2

CPE

  • cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*

Remediation

  • No remediation found in references.

Change History

43 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-6322
NVD Published Date:
May 5, 2026
NVD Last Modified:
Sep 10, 2026
Source:
openjs