https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-84394.htmlhttps://patchthecve.com/cve/CVE-2026-84394.htmlFri, 04 Sep 2026 16:12:20 +0000HIGH 7.5: fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the hoshttps://patchthecve.com/cve/CVE-2026-84292.htmlhttps://patchthecve.com/cve/CVE-2026-84292.htmlTue, 06 Oct 2026 22:10:00 +0000HIGH 7.5: fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to uhttps://patchthecve.com/cve/CVE-2026-76172.htmlhttps://patchthecve.com/cve/CVE-2026-76172.htmlWed, 14 Oct 2026 13:10:00 +0000HIGH 7.5: fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encodhttps://patchthecve.com/cve/CVE-2026-75975.htmlhttps://patchthecve.com/cve/CVE-2026-75975.htmlWed, 14 Oct 2026 13:10:00 +0000HIGH 7.5: fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example,https://patchthecve.com/cve/CVE-2026-75931.htmlhttps://patchthecve.com/cve/CVE-2026-75931.htmlWed, 14 Oct 2026 13:10:00 +0000HIGH 7.5: fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree https://patchthecve.com/cve/CVE-2026-75899.htmlhttps://patchthecve.com/cve/CVE-2026-75899.htmlWed, 14 Oct 2026 13:10:00 +0000HIGH 7.5: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such ashttps://patchthecve.com/cve/CVE-2026-18446.htmlhttps://patchthecve.com/cve/CVE-2026-18446.htmlWed, 02 Sep 2026 14:42:38 +0000HIGH 7.5: fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the