fast-uri vulnerable to improper path equivalence in relative reference normalization

影響: npm:fast-uri < 2.4.8 → 2.4.8, npm:fast-uri >= 3.0.0, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.0, < 4.2.3 → 4.2.3

fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one. For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)…

Read on GitHub Advisory Database

On 10/24/2026, 06:39 AM, GitHub Advisory Database published "fast-uri vulnerable to improper path equivalence in relative reference normalization" (type: Advisory). Severity is "Low" (low). Related technologies: JavaScript / Node.js. CVE: CVE-2026-110095.