fast-uri (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package fast-uri, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2026-6321 — CVSS 7.5 (high): fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal()…
• CVE-2026-6322 — CVSS 7.5 (high): fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters…