CVE-2026-6321

fast-uri vulnerable to path traversal via percent-encoded dot segments

View on CVE.org
Published May 4, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments
History
Type Values Removed Values Added
First Time appeared Openjsf
Openjsf fast-uri
CPEs cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*
Vendors & Products Openjsf
Openjsf fast-uri
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
First Time appeared Fast-uri
Fast-uri fast-uri
Vendors & Products Fast-uri
Fast-uri fast-uri
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.
Title fast-uri vulnerable to path traversal via percent-encoded dot segments
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
openjs
Published
Updated
Sep 10, 2026, 12:04 PM
Reserved
Apr 14, 2026, 8:23 PM

View source JSON

Updated
Sep 10, 2026, 12:04 PM

JSON

Status
Modified
Published
May 4, 2026, 8:16 PM
Modified
Nov 11, 2026, 11:10 PM

View source JSON

Severity
Important
Public date
May 4, 2026, 7:31 PM

View source Bugzilla JSON

Updated
May 6, 2026, 9:22 AM

JSON