Bug 2556007 (CVE-2026-110725)

Summary: CVE-2026-110725 fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aazores, abarbaro, abrianik, akhatavk, alizardo, anpicker, anthomas, aos-team-art-private, asdas, bbrownin, brasmith, bsmejkal, cdrage, cmah, cmyers, cochase, csuconic, dbruscin, dhanak, dnakabaa, doconnor, dpaolell, dranck, drosa, dschmidt, dsimansk, eaguilar, ebaron, ehelms, ggainey, ggrzybek, gparvin, gtully, hasun, ikhan, jachapma, jbalunas, jchui, jdelft, jfula, jhe, jlanda, jmatsuok, jowilson, jpasqual, jraez, jsherman, jtolenti, jupierce, juwatts, jwong, kaycoth, kingland, kshier, ktsao, kvanderr, lchilton, lcouzens, lgarciaa, lryznaro, mbiarnes, mdellweg, mhulan, mnovotny, mreynolds, msauton, mstipich, nboldt, nmoumoul, nyancey, oaljalju, omaciel, ometelka, osousa, parichar, pcreech, pjindal, ppalepu, ppostler, prdhamdh, progier, psrna, ptisnovs, rbobbitt, rchan, rexwhite, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rushinde, sausingh, sdawley, sfeifer, sghai, sidsharm, simaishi, smallamp, snegrini, spichugi, stcannon, sthirugn, suppawar, syedriko, tasato, tbish, tbordaz, tlavocat, tmalecek, tsze, ttakamiy, vashirov, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability to trigger cross-site scripting (XSS) by providing crafted input to applications that serialize or normalize relative Uniform Resource Identifiers (URIs) using the suffix reference option. Because the library fails to properly escape colons in the first path segment of relative paths, the generated string can be misinterpreted by downstream components as an absolute URI with an executable scheme.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-20 07:22:10 UTC 
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.