fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Priority LOW 39CWE-436Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 36 fixed, 14 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00512 43rd percentileScored 2026-11-07
Fix Partial fast-uri (fast-uri): 3.1.2fast-uri (npm): 3.1.2, 2.4.1Red Hat: 43 advisoriesRed Hat: 36 fixed, 14 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fast-uri | fast-uri | before 3.1.2 | 3.1.2 | Patch available | CNA |
| — | fast-uri (npm) | 3.0.0 to before 3.1.2 | 3.1.2 | Patch available | GHSA-v39h-62p7-jpjc |
| — | fast-uri (npm) | before 2.4.1 | 2.4.1 | Patch available | GHSA-v39h-62p7-jpjc |
- fast-uri Vendorfast-uri Affected before 3.1.2 Fixed in 3.1.2 Patch available CNA
- fast-uri (npm) Vendor— Affected 3.0.0 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-v39h-62p7-jpjc
- fast-uri (npm) Vendor— Affected before 2.4.1 Fixed in 2.4.1 Patch available GHSA-v39h-62p7-jpjc
Remediation
- Fix · CNA fast-uri (fast-uri) Fixed in 3.1.2
- Fix · GHSA-v39h-62p7-jpjc fast-uri (npm) Fixed in 3.1.2 Advisory →
- Fix · GHSA-v39h-62p7-jpjc fast-uri (npm) Fixed in 2.4.1 Advisory →
Red Hat 43 advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:61783 Released 2026-08-31 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
Show 40 more Red Hat advisories
- RHSA-2026:60855 Released 2026-08-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.3-0.3.hum1@aarch64, grafana13.1-13.1.3-0.3.hum1@src, grafana13.1-13.1.3-0.3.hum1@x86_64
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:57487 Released 2026-08-26 · Red Hat rating ImportantOpenShift Container Platform 4.18.54 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator +2
- RHSA-2026:57013 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
- RHSA-2026:54555 Released 2026-08-19 · Red Hat rating ImportantOpenShift Container Platform 4.19.43 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:56968 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.21.11 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.21 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +22
- RHSA-2026:56928 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:56366 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:54395 Released 2026-08-12 · Red Hat rating ImportantRed Hat Quay 3.17.4
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:43038 Released 2026-07-21 · Red Hat rating CriticalMigration Toolkit for Applications
- Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9
- RHSA-2026:42142 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/gateway-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9, registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9 +3
- RHSA-2026:42078 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
- RHSA-2026:41951 Released 2026-07-20 · Red Hat rating ImportantRed Hat Data Grid 8.6.2 security update
- Red Hat Data Grid 8.6.2
- RHSA-2026:41928 Released 2026-07-20 · Red Hat rating ImportantRed Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
- RHSA-2026:41066 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.16.5
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:40945 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:40118 Released 2026-07-15 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:37628 Released 2026-07-14 · Red Hat rating ImportantOpenShift Container Platform 4.20.29 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:37186 Released 2026-07-14 · Red Hat rating ImportantOpenShift Container Platform 4.21.24 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:37385 Released 2026-07-09 · Red Hat rating Importantrh-podman-desktop security advisory update
- Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.1-1.el10_2
- RHSA-2026:36754 Released 2026-07-08 · Red Hat rating ImportantRed Hat Developer Hub 1.10.2 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:34766 Released 2026-07-08 · Red Hat rating ImportantOpenShift Container Platform 4.19.37 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:36651 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
- RHSA-2026:34770 Released 2026-07-07 · Red Hat rating ImportantOpenShift Container Platform 4.21.23 security and extras update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9
- RHSA-2026:34374 Released 2026-07-01 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +5
- RHSA-2026:34342 Released 2026-07-01 · Red Hat rating CriticalCluster Observability Operator 1.5.0
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
- RHSA-2026:34160 Released 2026-07-01 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.13-2.el9ap, automation-controller-cli-4.7.13-2.el9ap, automation-controller-server-4.7.13-2.el9ap +7
- RHSA-2026:33683 Released 2026-06-30 · Red Hat rating ImportantRed Hat Quay 3.10.23
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:29795 Released 2026-06-30 · Red Hat rating ImportantOpenShift Container Platform 4.22.3 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:29800 Released 2026-06-30 · Red Hat rating ImportantOpenShift Container Platform 4.20.27 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:29796 Released 2026-06-30 · Red Hat rating ImportantOpenShift Container Platform 4.22.3 security and extras update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9
- RHSA-2026:29834 Released 2026-06-30 · Red Hat rating ImportantOpenShift Container Platform 4.21.22 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:30076 Released 2026-06-25 · Red Hat rating ImportantRed Hat Quay 3.12.19
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:29197 Released 2026-06-24 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:28571 Released 2026-06-23 · Red Hat rating ImportantRed Hat Quay 3.9.23
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:26234 Released 2026-06-16 · Red Hat rating ImportantRed Hat Developer Hub 1.9.5 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:26225 Released 2026-06-16 · Red Hat rating ImportantTechnical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
- RHSA-2026:25273 Released 2026-06-11 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.16.2 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9
- RHSA-2026:25271 Released 2026-06-11 · Red Hat rating Importantmulticluster engine for Kubernetes v2.11.0 General Availability
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix planned: Will not fix |
| Network Observability Operator | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Build of Podman Desktop - Tech Preview | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:34342 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 | Fixed | RHSA-2026:25273 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:34374 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:42142 |
| Red Hat Data Grid 8.6.2 | Fixed | RHSA-2026:41951 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:36754 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:26234 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:29197, RHSA-2026:61783 |
| Red Hat Edge Manager 1.0 | Fixed | RHSA-2026:36651 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:40118, RHSA-2026:40945 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Fixed | RHSA-2026:37385 |
| Red Hat Hardened Images | Fixed | RHSA-2026:60855 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:41928 |
| Red Hat Migration Toolkit for Applications 8.2 | Fixed | RHSA-2026:43038 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520, RHSA-2026:84734 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:57487 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:34766, RHSA-2026:54555 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:29800, RHSA-2026:37628 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:29834, RHSA-2026:34770, RHSA-2026:37186 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:29795, RHSA-2026:29796 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:56431 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:56366 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2026:57013 |
| Red Hat Openshift Data Foundation 4.21 | Fixed | RHSA-2026:56968 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:56928 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:33683 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:30076 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:41066 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:54395 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:28571 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:26225 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:25271 |
Not affected: 43 products
- Cluster Observability Operator 1.5
- Cryostat 4
- OpenShift Pipelines
- OpenShift Serverless
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.7
- Red Hat Developer Hub 1.10
- Red Hat Developer Hub 1.9
- Red Hat Discovery 2
- Red Hat Edge Manager 1.0
- Red Hat Edge Manager 1.1
- Red Hat Migration Toolkit 1.8
- Red Hat Migration Toolkit for Applications 8.2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Virtualization 4
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.19
- Red Hat Openshift Data Foundation 4.20
- Red Hat Openshift Data Foundation 4.21
- Red Hat Openshift Data Foundation 4.22
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
- Red Hat Satellite 6
- Red Hat build of Apache Camel - HawtIO 4
- multicluster engine for Kubernetes 2.11
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6322
- 2026-10-03 Alias added: GHSA-v39h-62p7-jpjc
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-10-25 Priority changed: MEDIUM → LOW
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
References
Advisory 3
Other 47
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:42078
- https://access.redhat.com/errata/RHSA-2026:42142
- https://access.redhat.com/errata/RHSA-2026:43038
- https://access.redhat.com/errata/RHSA-2026:54395
- https://access.redhat.com/errata/RHSA-2026:54555
- https://access.redhat.com/errata/RHSA-2026:56366
- https://access.redhat.com/errata/RHSA-2026:56431
- https://access.redhat.com/errata/RHSA-2026:56928
- https://access.redhat.com/errata/RHSA-2026:56968
- https://access.redhat.com/errata/RHSA-2026:57013
- https://access.redhat.com/errata/RHSA-2026:57487
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:60855
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/security/cve/CVE-2026-6322
- https://bugzilla.redhat.com/show_bug.cgi?id=2466684
- https://github.com/fastify/fast-uri
- https://github.com/fastify/fast-uri/releases/tag/v2.4.1
- https://github.com/fastify/fast-uri/releases/tag/v3.1.2
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6322.json
- https://access.redhat.com/errata/RHSA-2026:25271
- https://access.redhat.com/errata/RHSA-2026:25273
- https://access.redhat.com/errata/RHSA-2026:26225
- https://access.redhat.com/errata/RHSA-2026:26234
- https://access.redhat.com/errata/RHSA-2026:28571
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/errata/RHSA-2026:29795
- https://access.redhat.com/errata/RHSA-2026:29796
- https://access.redhat.com/errata/RHSA-2026:29800
- https://access.redhat.com/errata/RHSA-2026:29834
- https://access.redhat.com/errata/RHSA-2026:30076
- https://access.redhat.com/errata/RHSA-2026:33683
- https://access.redhat.com/errata/RHSA-2026:34160
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:34374
- https://access.redhat.com/errata/RHSA-2026:34766
- https://access.redhat.com/errata/RHSA-2026:34770
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36754
- https://access.redhat.com/errata/RHSA-2026:37186
- https://access.redhat.com/errata/RHSA-2026:37385
- https://access.redhat.com/errata/RHSA-2026:37628
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:41066
More Fast-uri vulnerabilities
- TI-2026-11539 fast-uri vulnerable to host confusion via failed IDN canonicalization CVSS 3.1HIGH 7.5
- TI-2026-05545 fast-uri vulnerable to path traversal via percent-encoded dot segments CVSS 3.1HIGH 7.5
- TI-2026-58005 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority CVSS 3.1HIGH 7.5
- TI-2026-53157 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references CVSS 3.1HIGH 7.5
- TI-2026-15158 fast-uri vulnerable to host confusion via backslash authority introducer CVSS 3.1HIGH 7.5
- TI-2026-13562 fast-uri vulnerable to host confusion via literal backslash authority delimiter CVSS 3.1HIGH 7.5
Sources
- CVE-2026-6322 · CVE Program
- CVE-2026-6322 · NVD
- FIRST EPSS
- GHSA-v39h-62p7-jpjc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-6322 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences