Sign in
Deutsch English Español Polski
High

fast-uri vulnerable to path traversal via percent-encoded dot segments

  • Disclosed: 08.05.2026
  • Updated: 11.10.2026 10:22

Impact

fast-uri v3.1.0 and earlier decodes percent-encoded path separators (%2F) and dot segments (%2E) before applying dot-segment removal in normalize() and equal(). This makes encoded path data behave like real / and .., so distinct URIs collapse onto the same normalized path.

For example, http://example.com/public/%2e%2e/admin normalizes to http://example.com/admin, and equal() considers them the same URI.

Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.

Patches

Upgrade to fast-uri >= 3.1.1, or if you are in the v2.x release line, v2.4.1

Workarounds

None. Upgrade to the patched version.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package fast-uri >= 3.0.0, < 3.1.1, < 2.4.1 3.1.1, 2.4.1

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness (CWE)
CWE-22
Platform
npm
Package
fast-uri
Disclosed
08.05.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-q3j6-qgpj-74h6 - CC BY 4.0

Vulnerability history: fast-uri

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (13) in the archive
Total entries
13
First → latest
05.2026 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 11
  • Medium 2

Disclosures per year

Severity:
  1. fast-uri vulnerable to authority injection via an unvalidated port in serialize
    High · 7.5 CVE-2026-84292 < 2.4.6, >= 3.0.0, < 3.1.7, >= 4.0.0, < 4.1.4 2.4.6, 3.1.7, 4.1.4
  2. fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
    High · 7.5 CVE-2026-84394 >= 2.4.5, < 2.4.6, >= 3.1.6, < 3.1.7, >= 4.1.3, < 4.1.4 2.4.6, 3.1.7, 4.1.4
  3. fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
    High · 7.5 CVE-2026-75931 >= 2.4.2, < 2.4.5, >= 3.1.3, < 3.1.6, >= 4.0.1, < 4.1.3 2.4.5, 3.1.6, 4.1.3
  4. fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
    High · 7.5 CVE-2026-75975 >= 2.3.1, < 2.4.5, >= 3.0.0, < 3.1.6, >= 4.0.0, < 4.1.3 2.4.5, 3.1.6, 4.1.3
  5. fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
    High · 7.5 CVE-2026-75899 >= 2.4.1, < 2.4.5, >= 3.1.2, < 3.1.6, >= 4.0.0, < 4.1.3 2.4.5, 3.1.6, 4.1.3
  6. fast-uri vulnerable to host confusion via percent-encoded scheme normalization
    High · 7.5 CVE-2026-76172 >= 2.3.1, < 2.4.5, >= 3.0.0, < 3.1.6, >= 4.0.0, < 4.1.3 2.4.5, 3.1.6, 4.1.3
  7. fast-uri vulnerable to host confusion via backslash authority introducer
    High · 7.5 CVE-2026-18446 < 2.4.4, >= 3.0.0, < 3.1.5, >= 4.0.0, < 4.1.2 2.4.4, 3.1.5, 4.1.2
  8. fast-uri vulnerable to host confusion via literal backslash authority delimiter
    High · 7.5 CVE-2026-16221 >= 2.3.1, < 2.4.3, >= 3.0.0, < 3.1.4, >= 4.0.0, < 4.1.1 2.4.3, 3.1.4, 4.1.1
  9. fast-uri vulnerable to host confusion via failed IDN canonicalization
    High · 7.5 CVE-2026-13676 >= 4.0.0, < 4.0.1, >= 3.0.0, < 3.1.3, >= 2.3.1, < 2.4.2 4.0.1, 3.1.3, 2.4.2
  10. fast-uri vulnerable to host confusion via percent-encoded authority delimiters
    High · 7.5 CVE-2026-6322 >= 3.0.0, < 3.1.2, < 2.4.1 3.1.2, 2.4.1
  11. fast-uri vulnerable to path traversal via percent-encoded dot segments this entry
    High · 7.5 CVE-2026-6321 >= 3.0.0, < 3.1.1, < 2.4.1 3.1.1, 2.4.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.