GHSA-xhq7-xmqj-769h

Source

https://github.com/advisories/GHSA-xhq7-xmqj-769h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xhq7-xmqj-769h/GHSA-xhq7-xmqj-769h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xhq7-xmqj-769h

Aliases

CVE-2026-110095

Published

2026-10-23T21:39:34Z

Modified

2026-10-23T21:45:04Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

fast-uri vulnerable to improper path equivalence in relative reference normalization

Details

Impact

fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one.

For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)) points at a different resource than resolve(base, ref), and equal() treats distinct references as the same.

Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.

Database specific

{
    "cwe_ids":  [
        "CWE-41"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-23T21:39:34Z",
    "nvd_published_at":  "2026-10-20T07:17:08Z",
    "severity":  "LOW"
}

References

Affected packages

npm / fast-uri

Package

Name: fast-uri; View open source insights on deps.dev
Purl: pkg:npm/fast-uri

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xhq7-xmqj-769h/GHSA-xhq7-xmqj-769h.json"

npm / fast-uri

Package

Name: fast-uri; View open source insights on deps.dev
Purl: pkg:npm/fast-uri

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.1.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xhq7-xmqj-769h/GHSA-xhq7-xmqj-769h.json"

npm / fast-uri

Package

Name: fast-uri; View open source insights on deps.dev
Purl: pkg:npm/fast-uri

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0

Fixed

4.2.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xhq7-xmqj-769h/GHSA-xhq7-xmqj-769h.json"