Live › vulnerability › CVE-2026-110095
Go to dashboardfast-uri's normalize() and serialize() wrongly strip leading ../ segments from relative references, changing what the reference points to. An attacker who controls a relative reference that the app normalizes before resolving can make it reach a different resource than intended.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:39 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| fast-uri | npm | < 2.4.8 | 2.4.8 |
| fast-uri | npm | >= 3.0.0, < 3.1.9 | 3.1.9 |
| fast-uri | npm | >= 4.0.0, < 4.2.3 | 4.2.3 |
Run npm ls fast-uri to see installed versions and check if any is below 2.4.8, 3.1.9, or 4.2.3.
2.4.8, 3.1.9, or 4.2.3 depending on the major line in useEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one.
For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)) points at a different resource than resolve(base, ref), and equal() treats distinct references as the same.
Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.
Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.
This page as .md · .json · in your agent: get_signal("CVE-2026-110095")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.