{"id":"ghsa-ghsa-xhq7-xmqj-769h","seq":661314,"kind":"advisory","title":"fast-uri vulnerable to improper path equivalence in relative reference normalization","url":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","permalink":"https://vulnpulse.app/items/ghsa-ghsa-xhq7-xmqj-769h","summary":"影響: npm:fast-uri < 2.4.8 → 2.4.8, npm:fast-uri >= 3.0.0, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.0, < 4.2.3 → 4.2.3\nfast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one. For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)…","severity":"low","techs":["nodejs"],"cves":["CVE-2026-110095"],"tags":["GHSA-xhq7-xmqj-769h","fast-uri","fast-uri","fast-uri"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:39:34.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}