{"schema_version":"1.9.0","id":"GHSA-q3j6-qgpj-74h6","published":"2026-05-08T17:15:09Z","modified":"2026-08-20T15:47:54.799099666Z","aliases":["CVE-2026-6321"],"related":["CGA-9j5f-2hwm-8hfc"],"summary":"fast-uri vulnerable to path traversal via percent-encoded dot segments","details":"### Impact\n\n`fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path.\n\nFor example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI.\n\nApplications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.\n\n### Patches\n\nUpgrade to `fast-uri` >= 3.1.1, or if you are in the v2.x release line, v2.4.1\n\n### Workarounds\n\nNone. Upgrade to the patched version.","affected":[{"package":{"name":"fast-uri","ecosystem":"npm","purl":"pkg:npm/fast-uri"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}]}],"database_specific":{"last_known_affected_version_range":"<= 3.1.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-q3j6-qgpj-74h6/GHSA-q3j6-qgpj-74h6.json"}},{"package":{"name":"fast-uri","ecosystem":"npm","purl":"pkg:npm/fast-uri"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.1"}]}],"database_specific":{"last_known_affected_version_range":"<= 2.4.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-q3j6-qgpj-74h6/GHSA-q3j6-qgpj-74h6.json"}}],"references":[{"type":"WEB","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6321"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.1"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.1"},{"type":"PACKAGE","url":"https://github.com/fastify/fast-uri"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466582"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-6321"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:57013"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:56928"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:56431"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:56366"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:42079"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:42078"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:37385"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:26420"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:26416"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:26234"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:26214"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:25123"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:25089"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24766"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24473"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:21338"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:20338"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:19238"}],"database_specific":{"cwe_ids":["CWE-22"],"github_reviewed":true,"github_reviewed_at":"2026-05-08T17:15:09Z","nvd_published_at":"2026-05-04T20:16:20Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}