CVE-2026-110095Low· 3.7▾ Sunlitfast-uri vulnerable to improper path equivalence in relative reference normalization
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
0.2%
Disclosed via GHSA
0.2% → 0.3%
fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one.
For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)) points at a different resource than resolve(base, ref), and equal() treats distinct references as the same.
Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.
Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.
fast-uri < 2.4.8fast-uri >= 3.0.0, < 3.1.9fast-uri >= 4.0.0, < 4.2.3Upgrade to a patched release:
fast-uri 2.4.8fast-uri 3.1.9fast-uri 4.2.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-110180Medium· 4.8fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110306Medium· 6.1fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
CVE-2026-6321High· 7.5fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions
CVE-2026-86818Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3
CVE-2026-86472Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv