Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

chore(deps-dev): bump fast-uri from 3.1.3 to 3.1.9

Open
Number: #162
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 7
Created: October 29, 2026 at 12:12 AM UTC
(about 8 hours ago)
Updated: October 29, 2026 at 12:13 AM UTC
(about 8 hours ago)
Labels:
dependencies javascript
Description:

Bumps fast-uri from 3.1.3 to 3.1.9.

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.8...v3.1.9

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

... (truncated)

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

This change is Reviewable

Package Dependencies
Package:
fast-uri
Ecosystem:
npm
Version Change:
3.1.3 → 3.1.9
Update Type:
Patch
Security Advisories
fast-uri vulnerable to authority injection via an unvalidated port in serialize
GHSA-qw65-cvwx-89v3 CVE-2026-84292 HIGH
### Impact `fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port ...
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
GHSA-58mr-gqgx-xq4g CVE-2026-84394 HIGH
### Impact `fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without reporting an error. A host that starts with `[` but does not end with `]`, such...
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
GHSA-hrr3-gc8f-f4qj CVE-2026-86472 MODERATE
### Impact `fast-uri` folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as `%41` decodes to a literal `A` that is never folded. F...
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
GHSA-w74x-v6f9-j3xg CVE-2026-110306 MODERATE
### Impact `fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a...
fast-uri vulnerable to improper path equivalence in relative reference normalization
GHSA-xhq7-xmqj-769h CVE-2026-110095 LOW
### Impact `fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that alg...
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
GHSA-wjr9-j795-jxcr CVE-2026-110180 MODERATE
### Impact `fast-uri` versions `>= 2.4.2, <= 2.4.7`, `>= 3.1.3, <= 3.1.8`, and `>= 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme...
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
GHSA-333x-w4r6-6crp CVE-2026-110725 LOW
### Impact `fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a reference that has no authority, emit a relative reference...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 16761141
UUID: 6089944484
Node ID: PR_kwDOOuJ_nM8AAAABLZYYXQ
Host: GitHub
Repository: Dustin4444/datatracker