fast-uri vulnerable to path traversal via percent-encoded dot segments
- Severity:
- High
Description
fast-uri v3.1.0 and earlier decodes percent-encoded path separators (%2F) and dot segments (%2E) before applying dot-segment removal in normalize() and equal(). This makes encoded path data behave like real / and .., so distinct URIs collapse onto the same normalized path.
For example, http://example.com/public/%2e%2e/admin normalizes to http://example.com/admin, and equal() considers them the same URI.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **<= 2.4.0 >= 3.0.0, <= 3.1.0** Patched version(s): **2.4.1 3.1.1**
References
- GHSA-q3j6-qgpj-74h6
- cna.openjsf.org
- security.access.redhat.com
- bugzilla.redhat.com
- access.redhat.com
- CVE-2026-6321
- CWE-22
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- fast-uri vulnerable to host confusion via percent-encoded authority delimiters - CVE-2026-6322
- Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - CVE-2026-44373
- Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - nitro - CVE-2026-44373
- fast-uri vulnerable to host confusion via failed IDN canonicalization - CVE-2026-13676
You might also like:
- Tags:
- npm
- fast-uri
Anything's wrong? Let us know Last updated on August 10, 2026