fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8,
    from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with
    the legacy global unescape() function before validating it, so an input whose decoded scheme is a
    dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a
    scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and
    then stores or renders the normalized or resolved result can turn an inert string into an executable
    javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the
    equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based
    allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of
    these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check
    the parsed scheme against an allowlist after normalization and use that same parsed result rather than the
    raw string. (CVE-2026-110306)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8,     from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with     the legacy global unescape() function before validating it, so an input whose decoded scheme is a     dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a     scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and     then stores or renders the normalized or resolved result can turn an inert string into an executable     javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the     equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based     allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of     these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check     the parsed scheme against an allowlist after normalization and use that same parsed result rather than the     raw string. (CVE-2026-110306)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477235	SCA: security update for fast-uri (GHSA-w74x-v6f9-j3xg)	Tenable Cloud Security	SCA Checks	Local	medium
477235	SCA: security update for fast-uri (GHSA-w74x-v6f9-j3xg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
367761	Linux Distros Unpatched Vulnerability : CVE-2026-110306	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-110306

medium

Tenable Plugins

medium

medium

medium