CVE-2026-6322: fast-uri Vulnerability Enables URI Authority Hijacking

The National Vulnerability Database has published details for CVE-2026-6322, a high-severity vulnerability (CVSS 7.5) affecting fast-uri versions up to 3.1.1. This flaw stems from how the normalize() function processes percent-encoded authority delimiters within the host component. Specifically, it decodes these delimiters and then re-emits them as raw separators during serialization.

This behavior allows an attacker to craft a URI that, when normalized, can redirect applications to an entirely different authority than the original input suggested. An example cited by the National Vulnerability Database involves a host combining an allowed domain with an encoded at-sign (%40) and a second, malicious domain. Post-normalization, the encoded at-sign becomes a raw userinfo separator, effectively hijacking the URI’s authority to the second domain.

For defenders, this means applications performing URL normalization before critical security checks—such as host allowlisting, redirect validation, or outbound request routing—are at risk. An attacker could exploit this to bypass security controls, directing internal requests or user traffic to malicious infrastructure. The National Vulnerability Database recommends updating to fast-uri version 3.1.2 or later to mitigate this risk.