PT-2026-36919 · Npm · Fast-Uri

Kaka + 2 · Published 2026-05-04 · Updated 2026-06-04 · CVE-2026-6321

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 3.1.1

Description The normalize() and equal() functions decode percent-encoded path separators and dot segments before performing dot-segment removal. This causes encoded path data to be treated as actual slashes and parent-directory references, allowing distinct URIs to collapse into the same normalized path. Consequently, applications using these functions to enforce path-based policies on attacker-controlled URLs may be bypassed, as a path appearing confined under an allowed prefix can normalize to a different location.

Recommendations Update to version 3.1.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-6321

GHSA-Q3J6-QGPJ-74H6

OPENSUSE-SU-2026:10750-1

Affected Products

Fast-Uri

References · 219

• https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39410 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29087 · Security Note
• https://osv.dev/vulnerability/GHSA-q3j6-qgpj-74h6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42033 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2950 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33894 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44457 · Security Note
• https://ubuntu.com/security/CVE-2026-6321 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41238 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42042 · Security Note