Description
fast-uri’s normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 4.2.3 >= 3.0.0, < 3.1.9 < 2.4.8** Patched version(s): **4.2.3 3.1.9 2.4.8**
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to improper path equivalence in relative reference normalization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets - CVE-2026-86472
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
- fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - CVE-2026-75931
- fast-uri vulnerable to host confusion via percent-encoded scheme normalization - CVE-2026-76172
You might also like:
See something that needs correcting? Let us knowUpdated October 23, 2026