Search: CVE-2026-110306

fast-uri versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2 improperly percent-decode the URI scheme component using a legacy function, allowing dangerous schemes to be interpreted as executable URLs. This behavior can lead to stored or reflected cross-site scripting (XSS) vulnerabilities by turning inert strings into executable javascript, data, or vbscript URLs. The issue is fixed in versions 2.4.8, 3.1.9, and 4.2.3 and later.