CVE-2026-110095 in fast-uri
Summary
by MITRE • 10/20/2026
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The fast-uri library serves as a dependency-free implementation for parsing and serializing Uniform Resource Identifiers according to RFC 3986 standards within Node.js environments. A critical logical flaw exists in versions prior to 2.4.8, specifically between 3.0.0 and 3.1.8, and from 4.0.0 through 4.2.2, where the normalize() and serialize() functions incorrectly apply RFC 3986 dot-segment removal algorithms to relative-path references. This behavior deviates from the specification, which dictates that such normalization should only occur on merged target paths during resolution against a base URI. Consequently, when these flawed versions process a relative reference containing parent-directory segments, they may erroneously drop leading components, effectively transforming a document-relative reference into a root-relative one.
This technical deviation creates significant security implications for applications relying on fast-uri for path manipulation or validation logic. When an application normalizes an attacker-supplied or user-controlled relative URI before resolving it against a base URL, the premature removal of dot-segments can cause the resulting resolved URI to escape its intended directory context. Instead of remaining within the expected subdirectory structure, the reference may point to resources at higher levels in the file system hierarchy or even absolute paths on different domains if further processing occurs. This behavior facilitates path traversal attacks where an adversary can bypass access controls by manipulating relative references to reach sensitive files or endpoints outside their authorized scope.
The operational impact extends beyond simple directory traversal. Applications that utilize normalized URIs as keys for caching mechanisms, data deduplication processes, or authorization checks are particularly vulnerable. If the normalization step alters the semantic meaning of a URI by stripping necessary path segments, it can lead to cache poisoning where legitimate requests are mapped to incorrect cached responses. In authorization contexts, this flaw could allow an attacker to bypass restrictions intended to limit access to specific resource paths, potentially leading to unauthorized data exposure or modification. The vulnerability is classified under CWE-20 Improper Input Validation and aligns with ATT&CK techniques related to Path Traversal and URI Manipulation, highlighting the risk of insufficient validation when handling external inputs that influence internal routing or file system operations.
To mitigate this vulnerability, users must upgrade fast-uri to version 2.4.8, 3.1.9, or 4.2.3, which corrects the normalization logic to adhere strictly to RFC 3986 requirements for relative paths. For environments where immediate upgrading is not feasible, a recommended workaround involves resolving the relative reference against its absolute base URI first and then normalizing the resulting absolute path. This approach ensures that dot-segment removal occurs only after the full context of the target location has been established, preventing the premature stripping of parent-directory segments that leads to scope escape. Implementing this resolution-first strategy maintains the integrity of the URI structure and prevents attackers from exploiting normalization inconsistencies to traverse outside intended boundaries.