Skip to main content

fast-uri CVE-2026-6321

| EUVDEUVD-2026-27129 HIGH
Path Traversal (CWE-22)
2026-05-04 openjs GHSA-q3j6-qgpj-74h6
Path Traversal Fast Uri
7.5
CVSS 3.1 · Vendor: openjs
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft URL with percent-encoded path traversal
  2. Delivery
    Submit to application endpoint
  3. Exploit
    Trigger fast-uri normalize() in authorization logic
  4. Execution
    Decoded path bypasses prefix check
  5. Impact
    Access restricted resource

Vulnerability Assessment

Weakness
CWE
CWE-22
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target application uses fast-uri's normalize() or equal() functions as part of a security decision - specifically for path-based authorization checks, URL allowlisting/denylisting, or route prefix validation on attacker-controlled URLs. Vulnerable pattern: comparing normalized URLs against security policies rather than performing authorization on raw paths. Applications only using fast-uri for display formatting, logging, or non-security URI manipulation are not exploitable. No authentication, special configuration, or user interaction required - remote unauthenticated exploitation succeeds against default fast-uri installations when used in vulnerable code patterns. Limiting factors: the application must actually pass attacker-controlled URLs through normalize()/equal() before security checks; applications performing authorization on raw URLs or using proper security boundaries (like routing before normalization) are not affected despite using the vulnerable library version.
Impact

Real-world risk is HIGH for specific deployment contexts despite no current KEV listing. CVSS 7.5 reflects maximum theoretical impact with network-accessible attack vector requiring no authentication or user interaction, resulting in high integrity impact (authorization bypass). However, actual exploitability depends entirely on whether the application uses fast-uri's normalize() or equal() functions as a security boundary for path-based authorization. The CVSS AC:L (low complexity) is accurate - exploitation requires only crafting URLs like '/allowed/path/../../../restricted/resource' with percent-encoding. EPSS data not yet available for this recent disclosure, but the attack pattern is well-understood (similar to historical path traversal bypasses in web frameworks). No public POC identified at time of analysis, but the vulnerability description provides sufficient detail for trivial reproduction. Priority for patching: CRITICAL for applications using fast-uri in authorization logic (API gateways, file servers, proxy routing rules); LOW for applications using it only for display or logging. SSVC assessment: Exploitation status is POC (trivial from description), Automatable (yes - static URL manipulation), Technical Impact is partial (authorization bypass to integrity violation). Missing signal: no data on whether Fastify framework itself uses these functions in security-critical paths.
Exploit ScenarioDerived

An API gateway uses fast-uri to validate that incoming request paths fall under an allowed prefix '/api/public/' before forwarding requests. An attacker crafts a malicious URL '/api/public/%2E%2E%2Fadmin/sensitive-data' where %2E%2E represents '..' (parent directory traversal). The fast-uri normalize() function decodes '%2E%2E' to literal '..' then applies dot-segment removal, collapsing the path to '/api/admin/sensitive-data'. The prefix check '/api/public/' passes on the original string but the normalized path routes to the restricted admin endpoint, bypassing authorization. No special prerequisites or authentication required - exploitation succeeds via a single crafted HTTP request. No public POC identified at time of analysis, but the attack is trivial to reproduce from the vulnerability description.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 04, 2026

Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls through percent-encoded path traversal sequences. The normalize() and equal() functions decode URL-encoded separators (%2F) and dot segments (%2E) before applying normalization rules, causing distinct URIs to collapse onto identical normalized paths. Applications relying on fast-uri for URL validation in authorization checks can be tricked into allowing access to restricted resources. EPSS exploitation probability not yet calculated given recent disclosure; no active exploitation confirmed (not in CISA KEV), but attack vector is trivial (CVSS AV:N/AC:L/PR:N/UI:N) and patch is available in version 3.1.1.

RemediationAI

Vendor-released patch: upgrade to fast-uri version 3.1.1 or later, which corrects the normalization order to treat percent-encoded characters as opaque path data per RFC 3986. Update via npm with 'npm update fast-uri' or yarn equivalent, then verify package-lock.json reflects version >=3.1.1. For applications unable to upgrade immediately, implement compensating controls: (1) Perform authorization checks on raw, non-normalized URLs to prevent normalization-based bypasses, with trade-off that legitimate equivalent URLs may be incorrectly denied; (2) Explicitly reject URLs containing percent-encoded slashes (%2F, %5C) and dots (%2E) in security-critical paths using a pre-filter (regex: /%2[EeFf]|%5[Cc]/i), noting this breaks legitimate use cases requiring encoded special characters; (3) Use an alternative URI normalization library like 'uri-js' for security boundaries while migrating to fast-uri 3.1.1. Advisory URLs: https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6 and https://cna.openjsf.org/security-advisories.html. Test authorization logic after patching to ensure intended access controls remain functional.

Affected VersionsENISA

fast-uri 0 <3.1.1

Affected Packages

npm fast-uri fix: 2.4.1, 3.1.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

fast-uri is a JavaScript URI parsing and normalization library used in the Fastify web framework ecosystem. The vulnerability stems from incorrect implementation of RFC 3986 normalization: the library decodes percent-encoded characters (like %2F for '/' and %2E for '.') before performing dot-segment removal per RFC 3986 Section 5.2.4, rather than treating encoded data as opaque path segments. This violates the principle that percent-encoding should preserve semantic distinctions between literal characters and special path syntax. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), manifesting as a normalization collision vulnerability. Affected package: cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:* (all versions through 3.1.0). Applications using this library for security-critical path comparison or prefix-matching authorization checks are vulnerable to authorization bypass.

Know when Fast Uri gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (openjs) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
Patch available
May 04, 2026 - 21:02 EUVD

DescriptionCVE.org

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

Executive ViewAI

Why It Matters

CVE-2026-6321 affects fast-uri library versions 3.1.0 and earlier, enabling remote attackers to bypass path-based access controls through URL encoding manipulation. Applications using fast-uri for authorization decisions are at risk of unauthorized access to restricted resources without requiring authentication or user interaction.

Business Impact: High
Compensating Controls

Vendor-released patch: fast-uri version 3.1.1 or later. If immediate upgrade is not possible, implement independent path normalization validation at the application layer before authorization checks; log and alert on percent-encoded path sequences (%2F, %2E) in URL paths; conduct manual code review of all authorization logic dependent on fast-uri output.

Threat Intelligence Overview

EPSS Score
0.0%
Top 92% exploitable
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

More in Fast Uri

View all
CVE-2026-75931 HIGH POC
7.5 Aug 24

Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste
CVE-2026-75975 HIGH POC
7.5 Aug 24

Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify eco
CVE-2026-75899 HIGH POC
7.5 Aug 24

Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and

CVE-2026-13676 HIGH POC
7.5 Jun 29

Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remot
CVE-2026-76172 HIGH POC
7.5 Aug 24

Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ
CVE-2026-84292 HIGH POC
7.5 Sep 02

URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the
CVE-2026-18446 HIGH POC
7.5 Jul 31

Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to
CVE-2026-6322 HIGH POC
7.5 May 05

Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T
CVE-2026-84394 HIGH POC
7.5 Sep 02

Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy ro
CVE-2026-16221 HIGH POC
7.5 Jul 19

Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2
CVE-2026-86818 MEDIUM POC
4.8 Sep 15

The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the res
CVE-2026-86472 MEDIUM POC
4.8 Sep 15

Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-6321 ADVISORY https://vuldb.com/vuln/361042 REF https://access.redhat.com/errata/RHSA-2026:19238 REF https://access.redhat.com/errata/RHSA-2026:20338 REF https://access.redhat.com/errata/RHSA-2026:21338 REF https://access.redhat.com/errata/RHSA-2026:24473 REF https://access.redhat.com/errata/RHSA-2026:24766 REF https://access.redhat.com/errata/RHSA-2026:24866 REF https://access.redhat.com/errata/RHSA-2026:24977 REF https://access.redhat.com/errata/RHSA-2026:25089 REF https://access.redhat.com/errata/RHSA-2026:25123 REF https://access.redhat.com/errata/RHSA-2026:26214 REF https://access.redhat.com/errata/RHSA-2026:26234 REF https://access.redhat.com/errata/RHSA-2026:26416 REF https://access.redhat.com/errata/RHSA-2026:26420 REF https://access.redhat.com/errata/RHSA-2026:34342 REF https://access.redhat.com/errata/RHSA-2026:37385 REF https://access.redhat.com/errata/RHSA-2026:42078 REF https://access.redhat.com/errata/RHSA-2026:42079 REF https://access.redhat.com/errata/RHSA-2026:56366 REF https://access.redhat.com/errata/RHSA-2026:56431 REF https://access.redhat.com/errata/RHSA-2026:56928 REF https://access.redhat.com/errata/RHSA-2026:57013 REF https://access.redhat.com/security/cve/CVE-2026-6321 REF https://bugzilla.redhat.com/show_bug.cgi?id=2466582 REF https://cna.openjsf.org/security-advisories.html REF https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy