Skip to content
Fencer Vulns
high 7.5

CVE-2026-6322 json

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

published 2026-05-05 6 mo ago modified 2026-09-10 59 d ago also GHSA-v39h-62p7-jpjc , EUVD-2026-27248

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

Patch / fix

  • npm fast-uri 2.4.1, 3.1.2
  • fast-uri fast-uri 3.1.2
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20260715-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20260715-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.10-1.el9ap
  • Red Hat Red Hat Enterprise Linux 10 0:1.1.1-1.el10_2
  • Red Hat Cluster Observability Operator 1.5.0 1782838476, 1782838753, 1782839193, 1782839279, 1782839494, 1782839981, 1782839996, 1782840519, 1782840539, 1782841925
  • Red Hat multicluster engine for Kubernetes 2.11 1780910888
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 1780600823
  • Red Hat Red Hat Ansible Automation Platform 2.6 1782721130, 1782761510
  • Red Hat Red Hat Ansible Automation Platform 2.7 1783919486
  • Red Hat Red Hat Developer Hub 1.10 1783448184
  • Red Hat Red Hat Developer Hub 1.9 1781187342
  • Red Hat Red Hat Discovery 2 1782166952, 1788206196
  • Red Hat Red Hat Edge Manager 1.0 1783502438, 1783502765
  • Red Hat Red Hat Edge Manager 1.1 1784126822, 1784127736, 1784194574, 1784194938
  • Red Hat Red Hat Hardened Images 13.1.3-0.3.hum1
  • Red Hat Red Hat Migration Toolkit 1.8 1783690532
  • Red Hat Red Hat Migration Toolkit for Applications 8.2 1784109883
  • Red Hat Red Hat OpenShift AI 3.4 1786611759, 1786612219, 1787121387, 1787250508, 1787250617, 1787251250, 1787251550, 1787347991
  • Red Hat Red Hat OpenShift Container Platform 4.18 1787031447
  • Red Hat Red Hat OpenShift Container Platform 4.19 1782880472, 1786486822
  • Red Hat Red Hat OpenShift Container Platform 4.20 1782313844, 1783602326
  • Red Hat Red Hat OpenShift Container Platform 4.21 1782308519, 1782914001, 1783502338
  • Red Hat Red Hat OpenShift Container Platform 4.22 1782224099, 1782224316, 1782224390
  • Red Hat Red Hat Openshift Data Foundation 4.18 1786705347, 1786705558, 1786705646, 1786705741, 1786705777, 1786705802, 1786705938, 1786706101, 1786706125, 1786706138, 1786706177, 1786706188, 1786706357, 1786706577, 1786706612, 1786706644, 1786706659, 1786706679, 1786706880
  • Red Hat Red Hat Openshift Data Foundation 4.19 1786701555, 1786701839, 1786702052, 1786702264, 1786702276, 1786702315, 1786702440, 1786702448, 1786702559, 1786702563, 1786702623, 1786702636, 1786702713, 1786702716, 1786702872, 1786702917, 1786702949, 1786703071, 1786703137, 1786703143
  • Red Hat Red Hat Openshift Data Foundation 4.20 1786626399, 1786627106, 1786627382, 1786627430, 1786627460, 1786627469, 1786627559, 1786628053, 1786628142, 1786628235, 1786628340, 1786628623, 1786629076, 1786629478, 1786629761, 1786631508, 1786632256, 1786644072, 1786687918, 1786688215
  • Red Hat Red Hat Openshift Data Foundation 4.21 1786627168, 1786627281, 1786627792, 1786627823, 1786628067, 1786628303, 1786628605, 1786628657, 1786628916, 1786628998, 1786629324, 1786629773, 1786630412, 1786630739, 1786631438, 1786634168, 1786644678, 1786697305, 1786697443, 1786698066
  • Red Hat Red Hat Openshift Data Foundation 4.22 1787057250, 1787057603, 1787057849, 1787057964, 1787057989, 1787058278, 1787058403, 1787058450, 1787058588, 1787058658, 1787058706, 1787058807, 1787058970, 1787059072, 1787059085, 1787059538, 1787059616, 1787059853, 1787060257, 1787061098
  • node-ajv Debian 14 8.20.0~ds+~cs6.1.3-1

debian advisories DEBIAN-CVE-2026-6322

  • grafana13.1 hummingbird 1 13.1.3-0.3.hum1
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.6-1.el8ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.6-1.el9ap
  • receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.6-1.el8ap
  • receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.6-1.el9ap
  • ansible-core ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1:2.16.19-1.el8ap
  • ansible-core ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1:2.16.19-1.el9ap
  • ansible-test ansible automation platform 2.5 1:2.16.19-1.el8ap

red hat advisories RHSA-2026:60855RHSA-2026:42078RHSA-2026:37385RHSA-2026:34160

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6322 updated cvss 7.5

fast-uri: fast-uri: URI authority bypass due to improper delimiter handling

  • Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-pccs
    affected: no fix planned “Will not fix”
  • Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-integrations-transform-jsonata-rhel9
    affected: no fix available
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Build of Podman Desktop rh-podman-desktop.git
    affected: no fix available
  • Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-bootc-rhel10
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 sgx-mpa, tdx-qgs, sgx-libs, sgx-pccs, linux-sgx, sgx-common, +2 more
    affected: no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel10, openshift5/ose-monitoring-plugin-rhel9, openshift5/ose-monitoring-plugin-rhel10 Red Hat Openshift Data Foundation 4 rhceph-dev/odf4-mcg-core-rhel9 Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: no fix available
show 25 more
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/logging-console-plugin-rhel9 1782841925, cluster-observability-operator/monitoring-console-plugin-rhel9 1782838476, cluster-observability-operator/logging-console-plugin-pf4-rhel9 1782839279, cluster-observability-operator/logging-console-plugin-pf5-rhel9 1782840539, cluster-observability-operator/distributed-tracing-console-plugin-rhel9 1782838753, cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9 1782839494, +4 more
    fixed: vendor fix RHSA-2026:34342
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/console-mce-rhel9 1780910888
    fixed: vendor fix RHSA-2026:25271
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/console-rhel9 1780600823
    fixed: vendor fix RHSA-2026:25273
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260715-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260715-1.el9ap
    fixed: vendor fix RHSA-2026:42078
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1782761510, ansible-automation-platform-tech-preview/mcp-server-rhel9 1782721130
    fixed: vendor fix RHSA-2026:34374
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.10-1.el9ap
    fixed: vendor fix RHSA-2026:34160
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1783919486
    fixed: vendor fix RHSA-2026:42142
  • Red Hat Data Grid 8.6.2
    fixed: vendor fix RHSA-2026:41951
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1781187342
    fixed: vendor fix RHSA-2026:26234
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1783448184
    fixed: vendor fix RHSA-2026:36754
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1782166952, discovery/discovery-ui-rhel9 1788206196
    fixed: vendor fix RHSA-2026:29197
  • Red Hat Edge Manager 1.0 rhem/flightctl-ui-rhel9 1783502438, rhem/flightctl-ui-ocp-rhel9 1783502765
    fixed: vendor fix RHSA-2026:36651
  • Red Hat Edge Manager 1.1 rhem/flightctl-ui-rhel9 1784127736, rhem/flightctl-ui-rhel10 1784194574, rhem/flightctl-ui-ocp-rhel9 1784126822, rhem/flightctl-ui-ocp-rhel10 1784194938
    fixed: vendor fix RHSA-2026:40945
  • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.1-1.el10_2
    fixed: vendor fix RHSA-2026:37385
  • Red Hat Hardened Images grafana13.1 13.1.3-0.3.hum1
    fixed: vendor fix RHSA-2026:60855
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1783690532
    fixed: vendor fix RHSA-2026:41928
  • Red Hat Migration Toolkit for Applications 8.2 mta/mta-solution-server-rhel9 1784109883
    fixed: vendor fix RHSA-2026:43038
  • Red Hat OpenShift AI 3.4 rhoai/odh-dashboard-rhel9 1787347991, rhoai/odh-mod-arch-maas-rhel9 1787251250, rhoai/odh-mod-arch-automl-rhel9 1787250508, rhoai/odh-mod-arch-gen-ai-rhel9 1786611759, rhoai/odh-mod-arch-mlflow-rhel9 1786612219, rhoai/odh-mod-arch-autorag-rhel9 1787251550, +3 more
    fixed: vendor fix RHSA-2026:60520
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-console-rhel9 1787031447
    fixed: vendor fix RHSA-2026:57487
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-console-rhel9 1786486822, openshift4/ose-monitoring-plugin-rhel9 1782880472
    fixed: vendor fix RHSA-2026:54555
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-console-rhel9 1783602326, openshift4/ose-monitoring-plugin-rhel9 1782313844
    fixed: vendor fix RHSA-2026:37628
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-console-rhel9 1783502338, openshift4/ose-monitoring-plugin-rhel9 1782308519, openshift4/nmstate-console-plugin-rhel9 1782914001
    fixed: vendor fix RHSA-2026:34770
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-console-rhel9 1782224390, openshift4/ose-monitoring-plugin-rhel9 1782224316, openshift4/nmstate-console-plugin-rhel9 1782224099
    fixed: vendor fix RHSA-2026:29796
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1786701839, odf4/odf-cli-rhel9 1786702440, odf4/mcg-core-rhel9 1786702052, odf4/odf-console-rhel9 1786703071, odf4/mcg-rhel9-operator 1786702559, odf4/ocs-rhel9-operator 1786702276, +14 more
    fixed: vendor fix RHSA-2026:56366

10 more fixed, 43 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm fast-uri
>=3.0.0, <3.1.2
<2.4.1
3.1.2
2.4.1

Affected products

  • fast-uri fast-uri
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Data Grid 8.6.2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7
  • Red Hat Red Hat Developer Hub 1.10
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Edge Manager 1.0
  • Red Hat Red Hat Edge Manager 1.1
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Migration Toolkit 1.8
  • Red Hat Red Hat Migration Toolkit for Applications 8.2
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat Openshift Data Foundation 4.21
  • Red Hat Red Hat Openshift Data Foundation 4.22
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.17
  • Red Hat Red Hat Quay 3.9
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Confidential Compute Attestation
  • Red Hat Cryostat 4
  • Red Hat Network Observability Operator
  • Red Hat OpenShift Lightspeed
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat Build of Podman Desktop
  • Red Hat Red Hat Build of Podman Desktop - Tech Preview
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-436 Interpretation Conflict
  • CWE-140 Improper Neutralization of Delimiters

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.