CVE-2026-6321 Details
Description
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.
A path traversal vulnerability has been identified in fast-uri versions through 3.1.0. The issue arises because the library decodes percent-encoded path separators and dot segments before removing dot segments in its normalization and equality comparison functions. This behavior allows distinct URIs to collapse into the same normalized path, potentially bypassing path-based policies in applications that normalize or compare URLs controlled by an attacker. For instance, a path that appears to be within an allowed prefix could normalize to a different location, creating a security risk.
Users are advised to upgrade to fast-uri version 3.1.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | redhat-SADP |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | openjs |
Affected Products
| Product | Versions |
|---|---|
| openjsf fast-uri | < 3.1.1 |
CPE
Remediation
| |
Change History
20 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 7, 2026 | CVE Modified | redhat-SADP |
| Sep 4, 2026 | CVE Modified | redhat-SADP |
| Sep 3, 2026 | CVE Modified | redhat-SADP |
| Sep 3, 2026 | CVE Modified | openjs |
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 20, 2026 | CVE Modified | redhat-SADP |
| Aug 19, 2026 | CVE Modified | redhat-SADP |
| Aug 18, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 16, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 2, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | openjs |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | New CVE Received | openjs |