fast-uri has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 4.8 (medium).
CVEs per month
Last 12 months, by publish date
1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
fast-uri vulnerabilities
CVEs affecting fast-uri, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-86818Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved nam…
▾ Sunlitfast-uri · fast-uriEPSS 0.16%via NVD
CVE-2026-86472Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the …
▾ Sunlitfast-uri · fast-uriEPSS 0.16%via NVD