Log in Start free

Vulnerability · Published May 4, 2026 · Assigned by openjs

CVE-2026-6321fast-uri vulnerable to path traversal via percent-encoded dot segments

High 7.5

In plain English

A high-severity path traversal in fast-uri from fast-uri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-ajvno fix listedDEBIAN-CVE-2026-6321
Debian:13node-ajvno fix listedDEBIAN-CVE-2026-6321
Debian:14node-ajv8.20.0~ds+~cs6.1.3-1DEBIAN-CVE-2026-6321
Ubuntu:22.04:LTSnode-ajvno fix listedUBUNTU-CVE-2026-6321
Ubuntu:24.04:LTSnode-ajvno fix listedUBUNTU-CVE-2026-6321
Ubuntu:25.10node-ajvno fix listedUBUNTU-CVE-2026-6321
Ubuntu:26.04:LTSnode-ajvno fix listedUBUNTU-CVE-2026-6321
Ubuntu:26.10node-ajvno fix listedUBUNTU-CVE-2026-6321
npmfast-uri3.1.1GHSA-q3j6-qgpj-74h6
npmfast-uri2.4.1GHSA-q3j6-qgpj-74h6

Affected products (as reported)

VendorProductVersions
fast-uri fast-uri 0 – before 3.1.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References