fast-uri vulnerable to improper path equivalence in relative reference normalization

影響: npm:fast-uri < 2.4.8 → 2.4.8, npm:fast-uri >= 3.0.0, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.0, < 4.2.3 → 4.2.3

fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one. For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)…

在 GitHub Advisory Database 阅读

2026/10/24 06:39，GitHub Advisory Database 发布了“fast-uri vulnerable to improper path equivalence in relative reference normalization”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js。CVE：CVE-2026-110095。