Search: CVE-2026-110725

fast-uri versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2 contain a vulnerability in the serialize(), normalize(), or resolve() functions when used with the non-default suffix reference option. This flaw allows the generation of a relative reference containing an unescaped colon in the first path segment, violating RFC 3986 and potentially causing the string to be interpreted as an absolute URI with a scheme. This can lead to cross-site scripting (XSS) vectors if the result is treated as a URI. The issue is fixed in versions 2.4.8, 3.1.9, and 4.2.3.