[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-6322":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T00:21:03.480Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":42,"aliases":43,"duplicate_of":9,"upstream":45,"downstream":46,"duplicates":55,"related":56,"reserved_at":9,"published_at":59,"modified_at":60,"state":61,"summary":62,"references_raw":71,"kevs":230,"epss":231,"epss_history":234,"metrics":420,"affected":430},"CVE-2026-6322","fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions \u003C= 3.1.1 are affected. Update to 3.1.2 or later.",null,[11,31],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-436","Interpretation Conflict","Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.","weakness","Incomplete","Class",[19,23,27],{"id":20,"name":21,"techniques":22},"CAPEC-105","HTTP Request Splitting",[],{"id":24,"name":25,"techniques":26},"CAPEC-273","HTTP Response Smuggling",[],{"id":28,"name":29,"techniques":30},"CAPEC-34","HTTP Response Splitting",[],{"_key":32,"id":32,"name":33,"description":34,"type":15,"status":35,"abstraction":36,"likelihood_of_exploit":9,"capec":37},"CWE-140","Improper Neutralization of Delimiters","The product does not neutralize or incorrectly neutralizes delimiters.","Draft","Base",[38],{"id":39,"name":40,"techniques":41},"CAPEC-15","Command Delimiters",[],[],[44],"GHSA-v39h-62p7-jpjc",[],[47,49,51,53],{"_key":48},"DEBIAN-CVE-2026-6322",{"_key":50},"UBUNTU-CVE-2026-6322",{"_key":52},"RHSA-2026:34160",{"_key":54},"RHSA-2026:37385",[],[57],{"_key":58},"CGA-5VR9-C8QR-FQVG","2026-05-05T10:29:16.378Z","2026-07-22T12:08:40.906Z","Analyzed",{"cisa_kev":63,"cisa_ransomware":63,"cisa_vendor":9,"epss_severity":64,"epss_score":65,"severity":66,"severity_score":67,"severity_version":68,"severity_source":69,"severity_vector":70,"severity_status":61},false,"low",0.00475,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",[72,80,84,89,94,100,105,110,114,118,122,126,130,134,138,142,146,150,154,158,162,166,170,174,178,182,186,190,194,198,202,206,210,214,218,222,226],{"url":73,"sources":74,"tags":77},"https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc",[69,75,76],"nvd","osv_npm",[78,79],"WEB","Vendor Advisory",{"url":81,"sources":82,"tags":83},"https://cna.openjsf.org/security-advisories.html",[69,75,76],[78,79],{"url":85,"sources":86,"tags":87},"https://nvd.nist.gov/vuln/detail/CVE-2026-6322",[76],[88],"Advisory",{"url":90,"sources":91,"tags":92},"https://github.com/fastify/fast-uri",[76],[93],"PACKAGE",{"url":95,"sources":96,"tags":97},"https://access.redhat.com/security/cve/CVE-2026-6322",[69],[98,99],"VDB Entry","X Refsource REDHAT",{"url":101,"sources":102,"tags":103},"https://bugzilla.redhat.com/show_bug.cgi?id=2466684",[69],[104,99],"Issue Tracking",{"url":106,"sources":107,"tags":108},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6322.json",[69],[109],"X Sadp Csaf Vex",{"url":111,"sources":112,"tags":113},"https://access.redhat.com/errata/RHSA-2026:25273",[69],[79,99],{"url":115,"sources":116,"tags":117},"https://access.redhat.com/errata/RHSA-2026:26234",[69],[79,99],{"url":119,"sources":120,"tags":121},"https://access.redhat.com/errata/RHSA-2026:29197",[69],[79,99],{"url":123,"sources":124,"tags":125},"https://access.redhat.com/errata/RHSA-2026:30076",[69],[79,99],{"url":127,"sources":128,"tags":129},"https://access.redhat.com/errata/RHSA-2026:28571",[69],[79,99],{"url":131,"sources":132,"tags":133},"https://access.redhat.com/errata/RHSA-2026:26225",[69],[79,99],{"url":135,"sources":136,"tags":137},"https://access.redhat.com/errata/RHSA-2026:25271",[69],[79,99],{"url":139,"sources":140,"tags":141},"https://access.redhat.com/errata/RHSA-2026:34160",[69],[79,99],{"url":143,"sources":144,"tags":145},"https://access.redhat.com/errata/RHSA-2026:34342",[69],[79,99],{"url":147,"sources":148,"tags":149},"https://access.redhat.com/errata/RHSA-2026:34374",[69],[79,99],{"url":151,"sources":152,"tags":153},"https://access.redhat.com/errata/RHSA-2026:29800",[69],[79,99],{"url":155,"sources":156,"tags":157},"https://access.redhat.com/errata/RHSA-2026:34770",[69],[79,99],{"url":159,"sources":160,"tags":161},"https://access.redhat.com/errata/RHSA-2026:29834",[69],[79,99],{"url":163,"sources":164,"tags":165},"https://access.redhat.com/errata/RHSA-2026:29796",[69],[79,99],{"url":167,"sources":168,"tags":169},"https://access.redhat.com/errata/RHSA-2026:29795",[69],[79,99],{"url":171,"sources":172,"tags":173},"https://access.redhat.com/errata/RHSA-2026:33683",[69],[79,99],{"url":175,"sources":176,"tags":177},"https://access.redhat.com/errata/RHSA-2026:36754",[69],[79,99],{"url":179,"sources":180,"tags":181},"https://access.redhat.com/errata/RHSA-2026:36651",[69],[79,99],{"url":183,"sources":184,"tags":185},"https://access.redhat.com/errata/RHSA-2026:34766",[69],[79,99],{"url":187,"sources":188,"tags":189},"https://access.redhat.com/errata/RHSA-2026:37385",[69],[79,99],{"url":191,"sources":192,"tags":193},"https://access.redhat.com/errata/RHSA-2026:37186",[69],[79,99],{"url":195,"sources":196,"tags":197},"https://access.redhat.com/errata/RHSA-2026:40945",[69],[79,99],{"url":199,"sources":200,"tags":201},"https://access.redhat.com/errata/RHSA-2026:40118",[69],[79,99],{"url":203,"sources":204,"tags":205},"https://access.redhat.com/errata/RHSA-2026:37628",[69],[79,99],{"url":207,"sources":208,"tags":209},"https://access.redhat.com/errata/RHSA-2026:41066",[69],[79,99],{"url":211,"sources":212,"tags":213},"https://access.redhat.com/errata/RHSA-2026:42078",[69],[79,99],{"url":215,"sources":216,"tags":217},"https://access.redhat.com/errata/RHSA-2026:42142",[69],[79,99],{"url":219,"sources":220,"tags":221},"https://access.redhat.com/errata/RHSA-2026:41951",[69],[79,99],{"url":223,"sources":224,"tags":225},"https://access.redhat.com/errata/RHSA-2026:41928",[69],[79,99],{"url":227,"sources":228,"tags":229},"https://access.redhat.com/errata/RHSA-2026:43038",[69],[79,99],[],{"date":232,"score":65,"percentile":233},"2026-07-05",0.37654,[235,239,242,245,248,251,254,258,261,265,268,271,274,277,280,283,286,289,293,296,299,302,305,308,311,314,316,319,322,324,327,329,331,335,338,341,344,347,350,352,355,358,362,365,368,371,374,377,380,383,385,388,391,394,397,400,403,407,410,413,416,419],{"date":236,"score":237,"percentile":238},"2026-05-05",0.00029,0.08109,{"date":240,"score":237,"percentile":241},"2026-05-06",0.08121,{"date":243,"score":237,"percentile":244},"2026-05-07",0.08242,{"date":246,"score":237,"percentile":247},"2026-05-08",0.08259,{"date":249,"score":237,"percentile":250},"2026-05-09",0.0831,{"date":252,"score":237,"percentile":253},"2026-05-10",0.08311,{"date":255,"score":256,"percentile":257},"2026-05-11",0.00038,0.11297,{"date":259,"score":256,"percentile":260},"2026-05-12",0.11338,{"date":262,"score":263,"percentile":264},"2026-05-13",0.00035,0.10368,{"date":266,"score":263,"percentile":267},"2026-05-14",0.1041,{"date":269,"score":263,"percentile":270},"2026-05-15",0.10408,{"date":272,"score":263,"percentile":273},"2026-05-16",0.10429,{"date":275,"score":263,"percentile":276},"2026-05-17",0.10407,{"date":278,"score":263,"percentile":279},"2026-05-18",0.10373,{"date":281,"score":263,"percentile":282},"2026-05-19",0.10331,{"date":284,"score":263,"percentile":285},"2026-05-20",0.10324,{"date":287,"score":263,"percentile":288},"2026-05-21",0.10301,{"date":290,"score":291,"percentile":292},"2026-05-22",0.00011,0.01542,{"date":294,"score":291,"percentile":295},"2026-05-23",0.0154,{"date":297,"score":291,"percentile":298},"2026-05-24",0.01545,{"date":300,"score":291,"percentile":301},"2026-05-25",0.01539,{"date":303,"score":291,"percentile":304},"2026-05-26",0.01534,{"date":306,"score":291,"percentile":307},"2026-05-27",0.01547,{"date":309,"score":291,"percentile":310},"2026-05-28",0.01543,{"date":312,"score":291,"percentile":313},"2026-05-29",0.01554,{"date":315,"score":291,"percentile":313},"2026-05-30",{"date":317,"score":291,"percentile":318},"2026-05-31",0.01553,{"date":320,"score":291,"percentile":321},"2026-06-01",0.01538,{"date":323,"score":291,"percentile":301},"2026-06-02",{"date":325,"score":291,"percentile":326},"2026-06-03",0.01532,{"date":328,"score":291,"percentile":326},"2026-06-04",{"date":330,"score":291,"percentile":295},"2026-06-05",{"date":332,"score":333,"percentile":334},"2026-06-06",0.00012,0.01906,{"date":336,"score":333,"percentile":337},"2026-06-07",0.01898,{"date":339,"score":333,"percentile":340},"2026-06-08",0.01885,{"date":342,"score":333,"percentile":343},"2026-06-09",0.01879,{"date":345,"score":333,"percentile":346},"2026-06-10",0.01878,{"date":348,"score":333,"percentile":349},"2026-06-11",0.01883,{"date":351,"score":333,"percentile":340},"2026-06-12",{"date":353,"score":333,"percentile":354},"2026-06-13",0.01886,{"date":356,"score":333,"percentile":357},"2026-06-14",0.01896,{"date":359,"score":360,"percentile":361},"2026-06-15",0.00277,0.19246,{"date":363,"score":360,"percentile":364},"2026-06-16",0.19273,{"date":366,"score":360,"percentile":367},"2026-06-17",0.1928,{"date":369,"score":360,"percentile":370},"2026-06-18",0.19297,{"date":372,"score":360,"percentile":373},"2026-06-19",0.19286,{"date":375,"score":360,"percentile":376},"2026-06-20",0.19275,{"date":378,"score":360,"percentile":379},"2026-06-21",0.19261,{"date":381,"score":360,"percentile":382},"2026-06-22",0.19248,{"date":384,"score":360,"percentile":370},"2026-06-23",{"date":386,"score":360,"percentile":387},"2026-06-24",0.19324,{"date":389,"score":360,"percentile":390},"2026-06-25",0.1942,{"date":392,"score":360,"percentile":393},"2026-06-26",0.19452,{"date":395,"score":360,"percentile":396},"2026-06-27",0.19489,{"date":398,"score":360,"percentile":399},"2026-06-28",0.1946,{"date":401,"score":360,"percentile":402},"2026-06-29",0.19456,{"date":404,"score":405,"percentile":406},"2026-06-30",0.00457,0.36349,{"date":408,"score":405,"percentile":409},"2026-07-01",0.36449,{"date":411,"score":65,"percentile":412},"2026-07-02",0.37601,{"date":414,"score":65,"percentile":415},"2026-07-03",0.37617,{"date":417,"score":65,"percentile":418},"2026-07-04",0.37636,{"date":232,"score":65,"percentile":233},[421,426,428],{"source":69,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":422,"cvss_v4_0":9},{"baseScore":67,"baseSeverity":423,"vectorString":70,"impactScore":424,"exploitabilityScore":425},"HIGH",6,10,{"source":75,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":427,"cvss_v4_0":9},{"baseScore":67,"baseSeverity":423,"vectorString":70,"impactScore":424,"exploitabilityScore":425},{"source":76,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":429,"cvss_v4_0":9},{"baseScore":67,"baseSeverity":9,"vectorString":70,"impactScore":424,"exploitabilityScore":425},[431,440,447],{"ecosystem":9,"name":432,"vendor":432,"product":432,"cpe_part":433,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":434},"fast-uri","a",[435],{"version":436,"is_range":437,"range_type":69,"version_start":9,"version_start_type":9,"version_end":438,"version_end_type":439,"fixed_in":9},"\u003C 3.1.2",true,"3.1.2","excluding",{"ecosystem":441,"name":432,"vendor":441,"product":432,"cpe_part":9,"purl_type":442,"purl_namespace":9,"purl_name":432,"source":9,"versions":443},"Npm","npm",[444],{"version":445,"is_range":437,"range_type":446,"version_start":9,"version_start_type":9,"version_end":438,"version_end_type":439,"fixed_in":9},"lt3_1_2","semver",{"ecosystem":9,"name":432,"vendor":448,"product":432,"cpe_part":433,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":449},"openjsf",[450],{"version":451,"is_range":437,"range_type":452,"version_start":9,"version_start_type":9,"version_end":438,"version_end_type":439,"fixed_in":9},"lt3.1.2","cpe"]