Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@4.2.3

Thanks to @zekth for reporting the scheme, host, and relative-reference issues, and to @UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: allow prerelease bump types in the release workflow by @mcollina in #230

Full Changelog: v4.2.2...v4.2.3

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @zekth for reporting the scheme, host, and relative-reference issues, and to @UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: enable trusted publishing releases (v3.x) by @mcollina in #229

Full Changelog: v3.1.8...v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 2.x. Applications that process untrusted URI input should upgrade to v2.4.8.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@2.4.8

Thanks to @zekth for reporting the scheme, host, and relative-reference issues, and to @UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: enable trusted publishing releases (v2.x) by @mcollina in #228

Full Changelog: v2.4.7...v2.4.8

What's Changed

• fix: reject invalid URI reference edges by @mcollina in #221
• fix: encode invalid host characters by @mcollina in #223
• fix: preserve dot segments in URN namespace strings by @mcollina in #222
• ci: enable trusted publishing releases by @Puppo in #225
• chore: bump playwright-test from 14.1.15 to 15.0.1 by @dependabot[bot] in #226

Full Changelog: v4.2.1...v4.2.2

What's Changed

• fix: make mailto normalization idempotent for authority recipients by @mcollina in #219

Full Changelog: v4.2.0...v4.2.1

What's Changed

• docs: clarify security vulnerability scope by @mcollina in #220
• fix: keep IPv6 zone identifiers stable across parse/normalize/serialize/equal by @mcollina in #218

Full Changelog: v4.1.5...v4.2.0

⚠️ Security Warning

This security release fixes the following medium-severity security advisories:

• GHSA-jvvf-x445-j334 — mailto header injection via percent-encoded field-name desynchronization
• GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v4 release line should upgrade to v4.1.5.

Full Changelog: v4.1.4...v4.1.5

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

• GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: v3.1.7...v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

• GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v2.x release line should upgrade to v2.4.7.

Full Changelog: v2.4.6...v2.4.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v4 release line should upgrade to v4.1.4.

Full Changelog: v4.1.3...v4.1.4