EUVD-2026-104812
GHSA-xhq7-xmqj-769h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted relative URI reference
-
ExploitApplication normalizes it via vulnerable normalize()/serialize()
-
ExecutionLeading parent-directory segment dropped, reference becomes root-relative
-
ImpactNormalized value resolves to or authorizes an unintended resource
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path traversal prevention
|
| Exploitation Conditions | Exploitation requires the consuming application to call fast-uri's normalize() or serialize() on an attacker- or user-supplied relative-path reference and then either resolve that pre-normalized reference or use it as a cache, deduplication, or authorization key - the condition is this specific normalize-before-resolve usage pattern, not a product configuration flag. The flaw does not trigger when a reference is first resolved against its absolute base and the absolute result is normalized (the documented workaround), nor against absolute references. Affected versions are fast-uri before 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2; limiting factors are the required vulnerable application logic and high attack complexity, which together make opportunistic mass exploitation unlikely. |
| Impact | This is a genuinely low-priority issue that the signals agree on. The vendor CVSS of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a network-reachable but high-complexity flaw with only low integrity impact and no confidentiality or availability impact. AC:H is well-justified: exploitation is not a property of the library alone but depends on the consuming application calling normalize()/serialize() on an attacker-supplied relative-path reference AND then using the result for resolution or as a cache, deduplication, or authorization key. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. PR:N correctly marks the library surface as unauthenticated, but note the real precondition is application-level (a specific, non-default usage pattern), not an authentication gate - so the practical attack surface is far narrower than AV:N/PR:N alone suggests. Also note a minor signal tension: the input tag 'Information Disclosure' implies a confidentiality effect, yet the CVSS vector sets C:N and I:L, framing this as an integrity/access-control bypass (a reference escaping its intended directory) rather than direct data disclosure - the downstream effect depends entirely on how the host application uses the normalized value. |
| Exploit ScenarioDerived | An application uses fast-uri's normalize() to canonicalize a user-supplied relative URI reference (e.g. for a cache key or an authorization check) before resolving it. An attacker submits a reference whose leading parent-directory ('../') segment is incorrectly stripped, turning a document-relative path into a root-relative one so it resolves to a different resource than intended, bypassing the directory boundary the key relied on. No public exploit code was identified at time of analysis, and the network attack vector is tempered by high complexity because the vulnerable normalize-then-trust pattern must already exist in the target application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Path-relative references are silently rewritten as root-relative in fast-uri before 2.4.8, in 3.0.0 through 3.1.8, and in 4.0.0 through 4.2.2, because normalize() and serialize() apply RFC 3986 dot-segment removal to a relative reference's path even though that algorithm is only defined for the merged target path during resolution. An unauthenticated remote attacker who can influence a reference that a consuming application normalizes and then resolves - or stores as a cache, deduplication, or authorization key - can cause that reference to escape its intended directory and designate a different resource, yielding a limited integrity impact; attack complexity is high because the vulnerable normalize-before-resolve usage pattern must exist in the host application. No public exploit identified at time of analysis, and no KEV listing.
RemediationAI
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3 (or any later release on the matching major line) - the fix is vendor-released and listed in GHSA-xhq7-xmqj-769h. Because the package is frequently a transitive dependency, pin the corrected version via an npm overrides/resolutions entry if the direct parent has not yet bumped its range, then rebuild the lockfile and verify the resolved tree. Where upgrading is not immediately possible, apply the vendor workaround: resolve the relative reference against its absolute base first and normalize the absolute result, and never call normalize() or serialize() on an untrusted relative reference before resolution; the trade-off is that this requires editing every consumer call site, and any call site missed remains vulnerable, so it should be treated as temporary. As a compensating control, stop using pre-normalized user-supplied references as cache, deduplication, or authorization keys and key on the fully resolved absolute URL instead - this adds a resolution step and may change key formats, requiring stored keys derived from previously normalized references to be audited or regenerated. Review application logic for the normalize-before-resolve ordering, since deployments that already resolve first are unaffected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js maintained in the Fastify/OpenJS ecosystem. Its normalize() and serialize() routines implement remove_dot_segments, but RFC 3986 §5.2.4 defines that step as part of the reference-resolution algorithm and applies it to the merged target path, not to the path of a standalone relative-path reference. By running dot-segment removal on a bare reference such as '../admin', the library collapses the leading parent-directory segment, converting a document-relative reference into a root-relative one ('/admin'). This is CWE-41 (Improper Resolution of Path Equivalence): two references that are not equivalent under the RFC are treated as the same, so any downstream consumer that resolves, caches, deduplicates, or authorizes on the normalized value makes a decision about the wrong resource. The behavior is only reachable through the specific normalize-before-resolve call pattern in the consuming application; absolute references and the documented resolve-then-normalize ordering are unaffected, which is why the assessed vector carries AC:H with only a low integrity impact (C:N/I:L/A:N).
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AV:N since references can arrive over the network and PR:N as the library imposes no auth, but AC:H because exploitation depends on a specific normalize-then-trust usage pattern; impact is limited to I:L (reference points at an unintended resource), with C:N/A:N.
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb
Lifecycle Timeline
2DescriptionCVE.org
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB