{
  "cve": "CVE-2026-6322",
  "ghsa": "GHSA-v39h-62p7-jpjc",
  "package": "fast-uri",
  "ecosystem": "npm",
  "affected_versions": "<= 3.1.1",
  "fixed_version": "3.1.2",
  "validation_status": "confirmed",
  "validation_timestamp": "2026-05-22T17:51:10Z",
  "test_input": "https://allowed.com%40attacker.com/",
  "vulnerable_result": {
    "version": "3.1.1",
    "normalized_uri": "https://allowed.com@attacker.com/",
    "parsed_host": "attacker.com",
    "parsed_userinfo": "allowed.com",
    "host_confusion_observed": true
  },
  "fixed_result": {
    "version": "3.1.2",
    "normalized_uri": "https://allowed.com%40attacker.com/",
    "parsed_host": "allowed.com%40attacker.com",
    "parsed_userinfo": null,
    "host_confusion_observed": false
  },
  "verdict": "The vulnerability is CONFIRMED. In fast-uri <= 3.1.1, normalize() decodes percent-encoded '@' (%40) inside the host component and re-emits it as a raw '@', causing the authority to be reinterpreted so that the text before '@' becomes userinfo and the effective host becomes attacker.com. In 3.1.2, the encoded delimiter is preserved in the host, preventing host confusion and defeating SSRF/allowlist bypasses built on normalize().",
  "repro_script": "repro/reproduction_steps.sh",
  "logs": {
    "vuln_result": "logs/vuln_result.json",
    "fixed_result": "logs/fixed_result.json"
  }
}