fast-uri CVE-2026-6321

Vendor-released patch: upgrade to fast-uri version 3.1.1 or later, which corrects the normalization order to treat percent-encoded characters as opaque path data per RFC 3986. Update via npm with 'npm update fast-uri' or yarn equivalent, then verify package-lock.json reflects version >=3.1.1. For applications unable to upgrade immediately, implement compensating controls: (1) Perform authorization checks on raw, non-normalized URLs to prevent normalization-based bypasses, with trade-off that legitimate equivalent URLs may be incorrectly denied; (2) Explicitly reject URLs containing percent-encoded slashes (%2F, %5C) and dots (%2E) in security-critical paths using a pre-filter (regex: /%2[EeFf]|%5[Cc]/i), noting this breaks legitimate use cases requiring encoded special characters; (3) Use an alternative URI normalization library like 'uri-js' for security boundaries while migrating to fast-uri 3.1.1. Advisory URLs: https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6 and https://cna.openjsf.org/security-advisories.html. Test authorization logic after patching to ensure intended access controls remain functional.