PT-2026-36919 · Npm · Fast-Uri

Kaka + 2 · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-6321

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 3.1.1

Description The normalize() and equal() functions decode percent-encoded path separators and dot segments before performing dot-segment removal. This causes encoded path data to be treated as actual slashes and parent-directory references, allowing distinct URIs to collapse into the same normalized path. Consequently, applications using these functions to enforce path-based policies on attacker-controlled URLs may be bypassed, as a path appearing confined under an allowed prefix can normalize to a different location.

Recommendations Update to version 3.1.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-6321

Affected Products

Fast-Uri

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-6321 · Security Note
• https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6 · Note
• https://twitter.com/kom_256/status/2051385546409173049 · Twitter Post
• https://twitter.com/CVEnew/status/2051403820144472340 · Twitter Post
• https://cna.openjsf.org/security-advisories.html · Note
• https://twitter.com/infoflowcloud/status/2051405558893146187 · Twitter Post