## fast-uri vulnerable to improper path equivalence in relative reference normalization

- 種別: advisory
- 重大度: low
- 関連技術: nodejs
- CVE: CVE-2026-110095
- 公開日時: 2026-10-23T21:39:34.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-xhq7-xmqj-769h)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-xhq7-xmqj-769h

影響: npm:fast-uri < 2.4.8 → 2.4.8, npm:fast-uri >= 3.0.0, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.0, < 4.2.3 → 4.2.3
fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one. For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)…