fast-uri is a dependency-free RFC 3986 URI toolbox for Node.js that provides helpers to parse, serialize, resolve, normalize, and compare URIs. It is useful when you need to work with URI components consistently, including configurable parsing options and scheme-specific processing rules.
Project status
- Actively maintained, with very recent GitHub activity (last upstream push on 2026-07-22) and multiple new
fast-uriupdates in mid-July 2026. - Apparent update cadence is fast and security-driven in the last week shown, with several updates clustered on 2026-07-17 through 2026-07-19, including multiple advisory-referenced security updates.
AI summary generated
Recent updates
v2.4.3
v2.4.3 is a security-focused update for fast-uri. The release notes only reference a GHSA, but the code diff shows substantial changes to URI parsing and normalization behavior to prevent authority delimiter and reserved escape handling from being exploited.
Securityv3.1.4
v3.1.4 is published as a security release for GHSA-v2hh-gcrm-f6hx. Despite the minimal release notes, the bundled code diff shows a significant internal rewrite of fast-uri's normalization, scheme handling, and comparison logic, including expanded URI component fields and new normalization behaviors around escaping and malformed inputs.
BreakingSecurityv4.1.1
v4.1.1 is presented as a security release with a fix for GHSA-v2hh-gcrm-f6hx. However, the actual code changes in the diff show a much broader refactor across URI normalization, scheme handling, IPv6/percent-encoding utilities, and TypeScript type surface area, with behavior changes that are not described in the release notes.
BreakingSecurityFeaturesv4.1.0
fast-uri v4.1.0 improves RFC 3986 compliance for percent-encoding normalization in URI query and fragment components. It also adjusts the dot-segment removal logic to preserve trailing empty path segments. The release notes only mention these two fixes, but the code introduces additional behavioral changes around parsing errors and how percent-encoded bytes are interpreted.
v2.4.2
Release v2.4.2 backports a security fix for IDN (Unicode) host canonicalisation from the GHSA-4c8g-83qw-93j6 advisory into the v2.x line. The code change updates how Unicode hosts are converted to ASCII during parsing, and adds tests to cover specific Unicode host forms.
Securityv2.4.1
v2.4.1 includes a small set of documented fixes and security backports, along with added tests. However, the actual code diff shows substantial internal changes to URI normalization, percent-encoding handling, and malformed input handling semantics that are not described in the release notes.
Securityv3.1.3
v3.1.3 is a security release referencing GHSA-4c8g-83qw-93j6. The release notes do not describe any functional behavior changes beyond the advisory fix.
Securityv4.0.1
fast-uri v4.0.1 ships a security release (GHSA-4c8g-83qw-93j6) and includes a documented change to normalize the parsed URI scheme to lowercase. The code diff, however, shows additional behavior changes around Unicode percent-encoding and IDN host canonicalization, plus TypeScript type export removals that are not described in the release notes.
BreakingSecurityv4.0.0
v4.0.0 migrates the type-test setup from tsd to tstyche, expands CI coverage to Node 26, and removes previously deprecated type exports. It also includes a fix to the percent-encoding/escaping logic used during URI normalization and escaping, with accompanying tests.
Breakingv3.1.2
fast-uri v3.1.2 is a security-focused release. Release notes state that malformed fragment decoding is now handled as a parse error instead of throwing. The code diff shows additional security and behavior changes beyond the documented fragment handling.
SecurityFeaturesv3.1.1
fast-uri v3.1.1 is primarily presented as a security release, with several CI and dev dependency maintenance updates. However, the code diff shows substantial changes to URI percent-encoding and path-escape normalization logic that can affect outputs of parse/normalize/equal and also changes what is exported from the package.
BreakingSecurityv3.1.0
v3.1.0 focuses on CI and test pipeline updates (node 24, browser testing, hardened workflow permissions) plus several URI correctness fixes. The library code also received substantial internal refactors in scheme handling and URI normalization utilities (IPv4/IPv6, dot segment removal, URN handling).
Featuresv3.0.6
v3.0.6 makes small refactors to the URI parsing and scheme detection logic, mainly simplifying condition checks and removing what the maintainers call “useless assertions.” It also adjusts the repository automation to reduce Dependabot update frequency.
v3.0.5
Release v3.0.5 focuses on maintaining compatibility with older Node.js versions (Node 10). The code changes mainly remove optional chaining syntax and the CI workflow adds a Node 10 regression test job. No runtime API changes are documented or evident in the diff.
v3.0.4
v3.0.4 mainly performs internal refactors and performance tweaks (cached IPv4 regex, optional chaining) while updating development tooling from Standard to NeoStandard/Eslint. It also includes README and CI/workflow configuration updates.
v3.0.3
Release v3.0.3 makes a small metadata correction in the fast-uri package manifest. The main change is updating the published npm license field.
Breakingv3.0.2
fast-uri v3.0.2 is a small release that switches the test runner from tap to tape, includes a minor serialization performance optimization, and updates the GitHub Actions workflows. It also claims a fix for parsing userinfo in URIs. The code diff shows the expected push-call optimizations and test framework changes, but there is an additional behavioral change in URI parsing for userinfo that is not spelled out in the release notes.
v3.0.1
v3.0.1 primarily addresses a fragment parsing incompatibility related to how URI fragments are decoded and re-encoded. The code change adjusts fragment handling behavior in the core `parse` function, and the release also adds an AJV-based test to validate URI resolver compatibility.
v3.0.0
v3.0.0 updates fast-uri parsing logic to better distinguish IP hosts from domain names during IDN conversion, and it improves internal IPv6 hex normalization. The release also adds extensive compatibility tests derived from uri-js and adjusts CI/test tooling.
Features