Detections
Analytics

SCA: security update for fast-uri (GHSA-333x-w4r6-6crp)

low Tenable Cloud Security Plugin ID 477229

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8,
 from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are
 called with the non-default option reference set to suffix on a reference that has no authority, the
 emitted relative reference can contain a bare colon in its first path segment without escaping it, even
 though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An
 application that serializes or normalizes a relative reference with the suffix option and then treats the
 result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting
 vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure
 is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri
 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround,
 avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment
 of the result before treating it as a URI. (CVE-2026-110725)

Solution

Update the fast-uri library and its related packages to version 2.4.8 or later.

See Also

https://github.com/advisories/GHSA-333x-w4r6-6crp

Plugin Details

Severity: Low

ID: 477229

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/24/2026

Updated: 10/24/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 50.36

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-110725

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 10/20/2026

Reference Information

CVE: CVE-2026-110725