CVE-2026-6321
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In the fast-uri library, the normalize() and equal() functions decoded percent-encoded path separators and dot segments before applying dot-segment removal. Encoded path data was treated as real slashes and parent-directory references, causing distinct URIs to collapse onto the same normalized path. Versions up to 3.1.0 are affected.
Risk Assessment
Applications that normalize or compare attacker-controlled URIs to enforce path-based access policies can be bypassed. An attacker can supply a path that appears to be within an allowed prefix but normalizes to a different, unauthorized location.
Recommendation
Update the fast-uri library to version 3.1.1 or later immediately. After updating, verify that path-based access control mechanisms work correctly.
Other vulnerabilities in fast-uri
See all- CVE-2026-76172High
The fast-uri URI parser for Node.js mishandles schemes with percent-encoded slashes, allowing an attacker to manipulate the host and bypass allowlists. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-75975High
The fast-uri URI parser for Node.js incorrectly validates bracketed IPv6 literals, allowing a malicious host to be transformed into a different IPv6 destination, such as loopback or private address. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-75931High
The fast-uri URI parser for Node.js does not canonicalize the host in scheme-relative references, leading to inconsistencies between parse, resolve, normalize, and equal functions. Affected versions are 2.4.2 up to 2.4.4, 3.1.3 up to 3.1.5, and 4.0.1 up to 4.1.2.
- CVE-2026-75899High
The fast-uri URI parser for Node.js decodes percent escapes in the hostname twice, potentially changing the destination to loopback or another internal address. Affected versions are 2.4.1 up to 2.4.4, 3.1.2 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-18446High
The fast-uri library before versions 4.1.2, 3.1.5, and 2.4.4 incorrectly parses URIs when a backslash is used instead of a double forward slash. Node.js treats backslash as interchangeable with forward slash, leading to differences in host parsing. Applications using fast-uri for host-based policy enforcement can be steered to an unintended host.
- CVE-2026-16221High
Vulnerability in fast-uri library (versions 2.3.1-4.1.0, 3.x up to 3.1.3, 2.x up to 2.4.2). Backslash is not treated as an authority delimiter, while Node's parser normalizes it to slash. Parsing discrepancy can bypass host-based policies (allowlists, SSRF filtering).
- CVE-2026-13676High
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. This causes discrepancies between fast-uri and Node's native URL parser, potentially bypassing host-based policies.
- CVE-2026-6322High
In fast-uri versions up to 3.1.1, the normalize() function decoded percent-encoded authority delimiters inside the host component and re-emitted them as raw delimiters during serialization. This allows an attacker to change the URI authority to a different domain than the input appeared to specify.
Original NVD description (English source)
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.