{"id":"CVE-2026-110095","kind":"vulnerability","aliases":["CVE-2026-110095","GHSA-xhq7-xmqj-769h"],"related":[],"title":"fast-uri vulnerable to improper path equivalence in relative reference normalization","description":"### Impact\n\n`fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading `..` segments and can turn a document-relative reference into a root-relative one.\n\nFor example, `normalize('a/../b')` returns `/b` and `normalize('../x')` returns `x`, so `resolve(base, normalize(ref))` points at a different resource than `resolve(base, ref)`, and `equal()` treats distinct references as the same.\n\nApplications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.\n\n### Patches\n\nUpgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.\n\n### Workarounds\n\nDo not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.","summary":"fast-uri's normalize() and serialize() wrongly strip leading ../ segments from relative references, changing what the reference points to. An attacker who controls a relative reference that the app normalizes before resolving can make it reach a different resource than intended.","severity":"low","cvss":3.7,"epss":0.00232,"exploited":false,"exploited_at":null,"products":[{"name":"fast-uri","fixed":["2.4.8"],"affected":"< 2.4.8","ecosystem":"npm"},{"name":"fast-uri","fixed":["3.1.9"],"affected":">= 3.0.0, < 3.1.9","ecosystem":"npm"},{"name":"fast-uri","fixed":["4.2.3"],"affected":">= 4.0.0, < 4.2.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-41","fast-uri","node","npm","package"],"not_affected_if":["no-relative-reference-normalization","uses-fixed-version"],"how_to_check":"Run npm ls fast-uri to see installed versions and check if any is below 2.4.8, 3.1.9, or 4.2.3.","fix":"Upgrade fast-uri to 2.4.8, 3.1.9, or 4.2.3 depending on the major line in use.\nUntil patched, resolve relative references against the absolute base before normalizing.","status":"open","published_at":"2026-10-20T07:17:08+00:00","first_seen_at":"2026-10-23T21:39:59+00:00","triaged_at":"2026-10-23T21:41:18+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:41:18Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade fast-uri to 2.4.8, 3.1.9, or 4.2.3 depending on the major line in use.\nUntil patched, resolve relative references against the absolute base before normalizing.","reach":"internet","impact":"low","summary":"fast-uri's normalize() and serialize() wrongly strip leading ../ segments from relative references, changing what the reference points to. An attacker who controls a relative reference that the app normalizes before resolving can make it reach a different resource than intended.","category":"package","who_cares":["npm","node","fast-uri"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker redirects a relative reference to a different resource on the same host.","analyst_note":"","how_to_check":"Run npm ls fast-uri to see installed versions and check if any is below 2.4.8, 3.1.9, or 4.2.3.\nunknown","needs_analyst":false,"not_affected_if":["no-relative-reference-normalization","uses-fixed-version"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000513,"input_tokens":3204,"output_tokens":386,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-110095':15A,23A '-2026':14A,22A '-41':34B '/b':158C '/x':161C '2.4.8':231C '3.1.9':232C '3986':93C,111C '4.2.3':234C '5.2.4':113C '769h':20A 'a/../b':156C 'absolut':249C,255C 'algorithm':116C 'app':70B 'appli':91C,131C 'applic':186C 'attack':62B,190C 'attacker-suppli':189C 'author':209C 'base':166C,176C,250C 'cach':206C 'chang':55B 'control':64B 'cve':13A,21A 'cwe':33B 'dedupl':207C 'defin':114C 'differ':79B,172C,223C 'directori':218C 'distinct':181C 'document':144C 'document-rel':143C 'dot':95C,99C 'dot-seg':94C 'drop':136C 'equal':179C 'equival':8A 'escap':215C 'exampl':154C 'fast':2A,25A,28A,31A,36B,42B,85C,229C 'fast-uri':1A,24A,27A,30A,35B,41B,84C,228C 'first':251C 'ghsa':17A 'ghsa-xhq7-xmqj-769h':16A 'impact':83C 'improp':6A 'intend':82B,217C 'key':210C 'lead':50B,137C 'make':75B 'merg':120C 'node':38B 'normal':12A,45B,71B,88C,155C,160C,167C,188C,238C,253C 'npm':39B 'one':152C 'packag':40B 'patch':225C 'path':7A,103C,108C,122C 'point':59B,169C,220C 'reach':77B 'ref':168C,177C 'refer':11A,54B,58B,67B,109C,128C,134C,146C,182C,197C,214C,241C 'relat':10A,53B,66B,107C,145C,151C,196C,240C 'relative-path':106C 'remov':97C,98C 'resolut':124C 'resolv':73B,165C,175C,200C,243C,245C 'resourc':80B,173C,224C 'result':256C 'return':157C,162C 'rfc':92C,110C 'root':150C 'root-rel':149C 'section':112C 'segment':51B,96C,100C,138C 'serial':47B,90C 'strip':49B 'suppli':191C,195C 'target':121C 'treat':180C 'turn':141C 'upgrad':226C 'uri':3A,26A,29A,32A,37B,43B,86C,230C 'use':203C 'user':194C 'user-suppli':193C 'vulner':4A 'workaround':235C 'wrong':48B 'x':163C 'xhq7':18A 'xmqj':19A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T07:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xhq7-xmqj-769h","url":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","severity":"low","published_at":"2026-10-23T21:39:34+00:00","modified_at":"2026-10-23T21:39:38+00:00","first_seen_at":"2026-10-23T21:39:59+00:00","fetched_at":"2026-10-23T21:45:07+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-110095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","severity":null,"published_at":"2026-10-20T07:17:08+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}