⌘ + K

GHSA-q3j6-qgpj-74h6

Dashboard / Vulnerabilities / GHSA-q3j6-qgpj-74h6

GHSA-q3j6-qgpj-74h6

Published: 8 May 2026Last Modified: 10 Sept 2026

Aliases:

CVE-2026-6321

Summary: fast-uri vulnerable to path traversal via percent-encoded dot segments

Details: ### Impact `fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path. For example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location. ### Patches Upgrade to `fast-uri` >= 3.1.1, or if you are in the v2.x release line, v2.4.1 ### Workarounds None. Upgrade to the patched version.

Affected packages

Package

Name: fast-uri

Purl: pkg:npm/fast-uri

Affected ranges

Type: SEMVER

Events:

Introduced- 3.0.0

Fixed -3.1.1

Affected versions

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High