CVE-2026-6321High· 7.5▾ Twilightfast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
0.5% → 0.8%
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.
fast-uri < 3.1.1Upgrade past the affected range:
fast-uri 3.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110095Low· 3.7fast-uri vulnerable to improper path equivalence in relative reference normalization
CVE-2026-13676High· 7.5fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
CVE-2026-6322High· 7.5fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization
CVE-2026-110180Medium· 4.8fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-110306Medium· 6.1fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding