fast-uri is a dependency-free RFC 3986 URI toolbox for Node.js that provides helpers to parse, serialize, resolve, normalize, and compare URIs. It is useful when you need to work with URI components consistently, including configurable parsing options and scheme-specific processing rules.
Project status
- Actively maintained: GitHub shows a very recent upstream push (2026-10-19), and multiple tagged updates landed within days (v2.4.8, v3.1.9, v4.2.3 all on 2026-10-19), indicating ongoing development rather than maintenance mode.
- Cadence: The pattern of several releases clustered in mid-September and again in late October 2026 suggests an evolving, security-hardening cadence, not a long quiet period (with the most recent activity only days ago).
AI summary generated
Recent updates
v2.4.8
The published release v2.4.8 release notes only mention a CI change to enable trusted publishing. However, the code diff for this release includes substantial URI parsing, normalization, serialization, and security hardening changes that are not described in the release notes.
Securityv3.1.9
The v3.1.9 release notes only mention CI changes for trusted publishing. However, the code diff from the previous tagged version shows a major rewrite of fast-uri’s parsing, normalization, scheme/host validation, and error behavior, with behavior changes that are not documented in the release notes.
Securityv4.2.3
Release v4.2.3 release notes only mention a CI workflow tweak to allow prerelease bump types. However, the provided code diff shows much larger functional changes, including stricter RFC 3986 validation in parsing/resolving/serializing, new scheme support for `mailto`, and TypeScript type surface changes.
SecurityFeaturesv4.2.2
v4.2.2 hardens URI parsing and resolution, adding stricter validation around malformed URI reference edges and improving host character handling. It also updates URI serialization behavior so URN namespace strings preserve dot segments as expected, and it introduces additional input validation for C0 controls/spaces.
Securityv4.2.1
v4.2.1 fixes an issue with `mailto` handling where inputs containing an authority component plus recipients could not reach a stable normalization result. The change ensures `normalize()` is idempotent for these authority-form inputs and adds a regression test suite covering the prior unbounded growth behavior.
Breakingv4.2.0
v4.2.0 documents a fix to keep IPv6 zone identifiers stable across parse/normalize/serialize/equal, plus a documentation clarification about the scope of reported security vulnerabilities. The code changes implement this by introducing an explicit ipv6Zone component field and by validating/propagating it during recomposition and recomposition-heavy operations.
v4.1.5
Release v4.1.5 is presented as a medium-severity security update covering two GHSA issues related to `mailto` handling and host case normalization. The code diff, however, shows substantially broader changes than the release notes describe, including new `mailto` scheme support, stricter validation, and behavior changes in comparison and error handling.
SecurityFeaturesv3.1.8
fast-uri v3.1.8 is presented as a medium-severity security release for GHSA-hrr3-gc8f-f4qj, fixing inconsistent host case normalization involving percent-encoded octets. However, the included code changes show a much broader refactor around parsing status, scheme validation, host canonicalization, and normalization behavior than the release notes describe.
BreakingSecurityv2.4.7
v2.4.7 is presented as a medium-severity security release for fast-uri. The published notes only describe a host case normalization fix related to percent-encoded octets, but the code diff shows substantially broader security hardening and stricter validation behavior across parse, normalize, resolve, equal, and serialize.
Securityv4.1.4
v4.1.4 is released as a security patch addressing two high-severity Fast-URI parsing/serialization issues (port-based authority injection, and host confusion with malformed IP-literals). However, the actual code changes also include multiple non-noted behavioral changes, including stricter validation/throwing in resolve(), changed equality semantics, removal of deprecated TypeScript exports, and expanded scheme support (notably mailto).
BreakingSecurityFeaturesv3.1.7
Release v3.1.7 is presented as a security-only patch addressing two high-severity fast-uri vulnerabilities. The provided code diff, however, shows a much broader internal refactor and multiple behavior changes (notably around parsing, host canonicalization, and error handling) that are not mentioned in the release notes.
BreakingSecurityFeaturesv2.4.6
v2.4.6 is presented as a security release for fast-uri, addressing two high severity issues: authority injection via an unvalidated port in serialize(), and host confusion due to malformed or misplaced IP-literal brackets. The code changes in this release go beyond those two notes and introduce more defensive parsing and stricter validation across normalize, equal, resolve, and several component serializers.
Securityv4.1.3
v4.1.3 is presented as a security release addressing multiple high-severity URI parsing and normalization issues related to host confusion and SSRF. The code diff, however, shows substantial behavioral changes beyond the stated advisories, including stricter parsing error handling, updated equality semantics, and new RFC 6068 mailto support. It also includes TypeScript declaration changes that remove deprecated exports.
BreakingSecurityv3.1.6
v3.1.6 is primarily a security release for fast-uri, addressing multiple high-severity host confusion and SSRF vectors listed in the release notes. The code diff shows a substantial internal rewrite of URI parsing, percent-encoding, scheme handling, and host canonicalization logic, which likely changes edge-case behaviors beyond what is explicitly documented.
BreakingSecurityv2.4.5
Release v2.4.5 primarily targets multiple high-severity security issues around URI parsing and normalization, particularly host confusion and malformed encoding handling. The release notes do not enumerate behavioral changes, but the code diff shows substantial internal rewrites affecting parse, normalize, equal, resolve, and serialization semantics.
Securityv2.4.4
v2.4.4 is released as a security fix for GHSA-7p8r-x3mc-p8w7. The code changes go beyond a simple patch, adding stricter URI parsing status (malformed authority and port detection), changing normalization and equality semantics around percent-encoded reserved characters, and improving host/authority escaping to prevent authority confusion.
BreakingSecurityv3.1.5
Release v3.1.5 primarily addresses a security advisory (GHSA-7p8r-x3mc-p8w7). However, the actual code diff includes multiple substantial behavioral changes around parsing, normalization, and equality that are not described in the release notes.
BreakingSecurityFeaturesv4.1.2
v4.1.2 is presented as a security fix for GHSA-7p8r-x3mc-p8w7, but the actual code changes introduce stricter URI parsing and normalization behavior around authority delimiters and percent-encoding. The release also includes multiple non-security behavior changes (query/fragment encoding normalization, scheme casing normalization, path dot-segment handling), plus TypeScript type definition changes and CI/tooling adjustments.
SecurityFeaturesv2.4.3
v2.4.3 is a security-focused update for fast-uri. The release notes only reference a GHSA, but the code diff shows substantial changes to URI parsing and normalization behavior to prevent authority delimiter and reserved escape handling from being exploited.
Securityv3.1.4
v3.1.4 is published as a security release for GHSA-v2hh-gcrm-f6hx. Despite the minimal release notes, the bundled code diff shows a significant internal rewrite of fast-uri's normalization, scheme handling, and comparison logic, including expanded URI component fields and new normalization behaviors around escaping and malformed inputs.
BreakingSecurity