{"id":"CVE-2026-6321","title":"fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions","summary":"fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-22"],"vendor":"openjsf","product":"fast-uri","affected":["fast-uri < 3.1.1"],"patched":["fast-uri 3.1.1"],"published":"2026-05-04","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:20:28.160","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6321","references":[{"url":"https://cna.openjsf.org/security-advisories.html","label":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","label":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"url":"https://access.redhat.com/errata/RHSA-2026:19238","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20338","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21338","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24473","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24766","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25089","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25123","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26214","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26234","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26416","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26420","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37385","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42078","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42079","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56366","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56431","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56928","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57013","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-6321","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466582","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6321"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6321"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-05-05T12:44:27.336265Z"},"epss":0.00634,"epssPercentile":0.48997,"ingestedAt":"2026-07-02T12:34:40.543Z","slug":"CVE-2026-6321","body":"## Overview\n\nfast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.\n\n## Affected\n\n- `fast-uri < 3.1.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `fast-uri 3.1.1`\n\n## Vendor advisories\n\n- **RHSA-2026:42078** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42078)\n- **RHSA-2026:42079** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42079)\n- **RHSA-2026:34342** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34342)\n- **RHSA-2026:37385** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 10) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37385)\n- **RHSA-2026:25089** · Red Hat · fixed in: HawtIO HawtIO 4.4.0 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:25089)\n- **RHSA-2026:24473** · Red Hat · fixed in: Network Observability (NETOBSERV) 1.12.2 · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24473)\n- **RHSA-2026:24766** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24766)\n- **RHSA-2026:24866** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24866)\n- **RHSA-2026:21338** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-05-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:21338)\n- **RHSA-2026:26234** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-06-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:26234)\n- **RHSA-2026:20338** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20338)\n- **Red Hat VEX** · Important · affected: Confidential Compute Attestation, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop, Red Hat Build of Podman Desktop - Tech Preview, Red Hat Data Grid 8, … · no fix planned: Red Hat Developer Hub, Confidential Compute Attestation, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, … · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}