CVE-2026-6321High· 7.5▾ Twilightfast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
0.5% → 0.6%
Last analysed / modified upstream
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.
fast-uri < 3.1.1Upgrade past the affected range:
fast-uri 3.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-13676High· 7.5fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
CVE-2026-6322High· 7.5fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization
CVE-2026-86818Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3
CVE-2026-86472Medium· 4.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv
CVE-2026-17495Medium· 5.9moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates
CVE-2026-18427High· 7.5@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass