fast-uri is a dependency-free RFC 3986 URI toolbox for Node.js that provides helpers to parse, serialize, resolve, normalize, and compare URIs. It is useful when you need to work with URI components consistently, including configurable parsing options and scheme-specific processing rules.
Project status
- Actively maintained, upstream shows a very recent push (2026-09-02) and multiple published security-focused updates clustered across late August to early September 2026.
- Apparent update cadence is frequent during this window (several versions within about 10 days, including consecutive-day updates around 2026-09-02), suggesting rapid turnaround for security and hardening work.
AI summary generated
Recent updates
v4.1.4
v4.1.4 is released as a security patch addressing two high-severity Fast-URI parsing/serialization issues (port-based authority injection, and host confusion with malformed IP-literals). However, the actual code changes also include multiple non-noted behavioral changes, including stricter validation/throwing in resolve(), changed equality semantics, removal of deprecated TypeScript exports, and expanded scheme support (notably mailto).
BreakingSecurityFeaturesv3.1.7
Release v3.1.7 is presented as a security-only patch addressing two high-severity fast-uri vulnerabilities. The provided code diff, however, shows a much broader internal refactor and multiple behavior changes (notably around parsing, host canonicalization, and error handling) that are not mentioned in the release notes.
BreakingSecurityFeaturesv2.4.6
v2.4.6 is presented as a security release for fast-uri, addressing two high severity issues: authority injection via an unvalidated port in serialize(), and host confusion due to malformed or misplaced IP-literal brackets. The code changes in this release go beyond those two notes and introduce more defensive parsing and stricter validation across normalize, equal, resolve, and several component serializers.
Securityv4.1.3
v4.1.3 is presented as a security release addressing multiple high-severity URI parsing and normalization issues related to host confusion and SSRF. The code diff, however, shows substantial behavioral changes beyond the stated advisories, including stricter parsing error handling, updated equality semantics, and new RFC 6068 mailto support. It also includes TypeScript declaration changes that remove deprecated exports.
BreakingSecurityv3.1.6
v3.1.6 is primarily a security release for fast-uri, addressing multiple high-severity host confusion and SSRF vectors listed in the release notes. The code diff shows a substantial internal rewrite of URI parsing, percent-encoding, scheme handling, and host canonicalization logic, which likely changes edge-case behaviors beyond what is explicitly documented.
BreakingSecurityv2.4.5
Release v2.4.5 primarily targets multiple high-severity security issues around URI parsing and normalization, particularly host confusion and malformed encoding handling. The release notes do not enumerate behavioral changes, but the code diff shows substantial internal rewrites affecting parse, normalize, equal, resolve, and serialization semantics.
Securityv2.4.4
v2.4.4 is released as a security fix for GHSA-7p8r-x3mc-p8w7. The code changes go beyond a simple patch, adding stricter URI parsing status (malformed authority and port detection), changing normalization and equality semantics around percent-encoded reserved characters, and improving host/authority escaping to prevent authority confusion.
BreakingSecurityv3.1.5
Release v3.1.5 primarily addresses a security advisory (GHSA-7p8r-x3mc-p8w7). However, the actual code diff includes multiple substantial behavioral changes around parsing, normalization, and equality that are not described in the release notes.
BreakingSecurityFeaturesv4.1.2
v4.1.2 is presented as a security fix for GHSA-7p8r-x3mc-p8w7, but the actual code changes introduce stricter URI parsing and normalization behavior around authority delimiters and percent-encoding. The release also includes multiple non-security behavior changes (query/fragment encoding normalization, scheme casing normalization, path dot-segment handling), plus TypeScript type definition changes and CI/tooling adjustments.
SecurityFeaturesv2.4.3
v2.4.3 is a security-focused update for fast-uri. The release notes only reference a GHSA, but the code diff shows substantial changes to URI parsing and normalization behavior to prevent authority delimiter and reserved escape handling from being exploited.
Securityv3.1.4
v3.1.4 is published as a security release for GHSA-v2hh-gcrm-f6hx. Despite the minimal release notes, the bundled code diff shows a significant internal rewrite of fast-uri's normalization, scheme handling, and comparison logic, including expanded URI component fields and new normalization behaviors around escaping and malformed inputs.
BreakingSecurityv4.1.1
v4.1.1 is presented as a security release with a fix for GHSA-v2hh-gcrm-f6hx. However, the actual code changes in the diff show a much broader refactor across URI normalization, scheme handling, IPv6/percent-encoding utilities, and TypeScript type surface area, with behavior changes that are not described in the release notes.
BreakingSecurityFeaturesv4.1.0
fast-uri v4.1.0 improves RFC 3986 compliance for percent-encoding normalization in URI query and fragment components. It also adjusts the dot-segment removal logic to preserve trailing empty path segments. The release notes only mention these two fixes, but the code introduces additional behavioral changes around parsing errors and how percent-encoded bytes are interpreted.
v2.4.2
Release v2.4.2 backports a security fix for IDN (Unicode) host canonicalisation from the GHSA-4c8g-83qw-93j6 advisory into the v2.x line. The code change updates how Unicode hosts are converted to ASCII during parsing, and adds tests to cover specific Unicode host forms.
Securityv2.4.1
v2.4.1 includes a small set of documented fixes and security backports, along with added tests. However, the actual code diff shows substantial internal changes to URI normalization, percent-encoding handling, and malformed input handling semantics that are not described in the release notes.
Securityv3.1.3
v3.1.3 is a security release referencing GHSA-4c8g-83qw-93j6. The release notes do not describe any functional behavior changes beyond the advisory fix.
Securityv4.0.1
fast-uri v4.0.1 ships a security release (GHSA-4c8g-83qw-93j6) and includes a documented change to normalize the parsed URI scheme to lowercase. The code diff, however, shows additional behavior changes around Unicode percent-encoding and IDN host canonicalization, plus TypeScript type export removals that are not described in the release notes.
BreakingSecurityv4.0.0
v4.0.0 migrates the type-test setup from tsd to tstyche, expands CI coverage to Node 26, and removes previously deprecated type exports. It also includes a fix to the percent-encoding/escaping logic used during URI normalization and escaping, with accompanying tests.
Breakingv3.1.2
fast-uri v3.1.2 is a security-focused release. Release notes state that malformed fragment decoding is now handled as a parse error instead of throwing. The code diff shows additional security and behavior changes beyond the documented fragment handling.
SecurityFeaturesv3.1.1
fast-uri v3.1.1 is primarily presented as a security release, with several CI and dev dependency maintenance updates. However, the code diff shows substantial changes to URI percent-encoding and path-escape normalization logic that can affect outputs of parse/normalize/equal and also changes what is exported from the package.
BreakingSecurity