CVE-2026-6321: Fast uri Remote Code Execution Vulnerability

Q: What is CVE-2026-6321?

CVE-2026-6321 is a security vulnerability in Fast uri involving fast-uri vulnerable to path traversal via percent-encoded dot segments under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Q: Which Fast uri versions are affected?

Affected versions include releases prior to 3.1.1, 2.4.1 across affected packages: fast-uri.

Q: What version fixes CVE-2026-6321?

Upgrading to 3.1.1, 2.4.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is fast-uri affected?

Yes, fast-uri is affected in releases prior to 3.1.1, 2.4.1. Upgrade your dependency to 3.1.1, 2.4.1 or later.

Q: What is the CVSS score of CVE-2026-6321?

CVE-2026-6321 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Q: What CWE is associated with CVE-2026-6321?

CVE-2026-6321 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).

Q: How can I check npm dependencies for CVE-2026-6321?

Run the dependency tree command: 'npm ls fast-uri'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-q3j6-qgpj-74h6

CVSS 7.5

CWE-22

Published 2026-05-08

Advisory Summary

CVE-2026-6321 is a HIGH (CVSS 7.5) remote code execution vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Fast uri libraries in the npm ecosystem. The issue involves fast-uri vulnerable to path traversal via percent-encoded dot segments. Remediation is available by upgrading affected packages to version 3.1.1, 2.4.1.

CVE-2026-6321 at a Glance

CVE Identifier CVE-2026-6321

GHSA Identifier GHSA-q3j6-qgpj-74h6

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Product Fast uri

Package Ecosystem npm

Published Date 2026-05-08

Last Updated 2026-08-20

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity High (I:H)

Availability None (A:N)

How to Fix CVE-2026-6321

To remediate this vulnerability, upgrade all affected Fast uri dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

fast-uri fixed: 3.1.1

npm install fast-uri@3.1.1

fast-uri fixed: 2.4.1

npm install fast-uri@2.4.1

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

npm ls fast-uri

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-6321, inspect your project dependencies using npm:

npm ls fast-uri

Analyze the terminal output to locate any version of Fast uri in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.1.1), your application is affected.

Note: The npm ls fast-uri command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Fast uri, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact `fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path. For example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location. ### Patches Upgrade to `fast-uri` >= 3.1.1, or if you are in the v2.x release line, v2.4.1 ### Workarounds None. Upgrade to the patched version.

CVE-2026-6321 Affected Fast uri Versions

2 component(s)

Fixed Versions:

3.1.12.4.1

Product / Package	Ecosystem	Affected Versions	Fixed Version
fast-uri npm/fast-uri	npm	≥ 3.0.0 < 3.1.1	3.1.1
fast-uri npm/fast-uri	npm	< 2.4.1	2.4.1

References

GitHub Advisory / Wiki ADVISORY

https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6

NVD — CVE-2026-6321 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-6321

Fast uri Security Information SECURITY

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json

Fast uri Release RELEASE

https://github.com/fastify/fast-uri/releases/tag/v3.1.1

Fast uri Release RELEASE

https://github.com/fastify/fast-uri/releases/tag/v2.4.1

Fast uri Source Repository REPOSITORY

https://github.com/fastify/fast-uri

Fast uri Security Information SECURITY

https://cna.openjsf.org/security-advisories.html

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2466582

Fast uri Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2026-6321

access.redhat.com/errata/rhsa-2026:57... WEB

https://access.redhat.com/errata/RHSA-2026:57013

access.redhat.com/errata/rhsa-2026:56... WEB

https://access.redhat.com/errata/RHSA-2026:56928

access.redhat.com/errata/rhsa-2026:56... WEB

https://access.redhat.com/errata/RHSA-2026:56431

access.redhat.com/errata/rhsa-2026:56... WEB

https://access.redhat.com/errata/RHSA-2026:56366

access.redhat.com/errata/rhsa-2026:42... WEB

https://access.redhat.com/errata/RHSA-2026:42079

access.redhat.com/errata/rhsa-2026:42... WEB

https://access.redhat.com/errata/RHSA-2026:42078

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37385

access.redhat.com/errata/rhsa-2026:34... WEB

https://access.redhat.com/errata/RHSA-2026:34342

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26420

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26416

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26234

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26214

access.redhat.com/errata/rhsa-2026:25... WEB

https://access.redhat.com/errata/RHSA-2026:25123

access.redhat.com/errata/rhsa-2026:25... WEB

https://access.redhat.com/errata/RHSA-2026:25089

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:24977

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:24866

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:24766

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:24473

access.redhat.com/errata/rhsa-2026:21... WEB

https://access.redhat.com/errata/RHSA-2026:21338

access.redhat.com/errata/rhsa-2026:20... WEB

https://access.redhat.com/errata/RHSA-2026:20338

access.redhat.com/errata/rhsa-2026:19... WEB

https://access.redhat.com/errata/RHSA-2026:19238

Frequently Asked Questions

What is CVE-2026-6321?

CVE-2026-6321 is a security vulnerability in Fast uri involving fast-uri vulnerable to path traversal via percent-encoded dot segments under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Which Fast uri versions are affected?

Affected versions include releases prior to 3.1.1, 2.4.1 across affected packages: fast-uri.

What version fixes CVE-2026-6321?

Upgrading to 3.1.1, 2.4.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Is fast-uri affected?

Yes, fast-uri is affected in releases prior to 3.1.1, 2.4.1. Upgrade your dependency to 3.1.1, 2.4.1 or later.

What is the CVSS score of CVE-2026-6321?

CVE-2026-6321 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

What CWE is associated with CVE-2026-6321?

CVE-2026-6321 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).

How can I check npm dependencies for CVE-2026-6321?

Run the dependency tree command: 'npm ls fast-uri'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q3j6-qgpj-74h6",
  "modified" : "2026-08-20T15:33:04Z",
  "published" : "2026-05-08T17:15:09Z",
  "aliases" : [ "CVE-2026-6321" ],
  "summary" : "fast-uri vulnerable to path traversal via percent-encoded dot segments",
  "details" : "### Impact\n\n`fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path.\n\nFor example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI.\n\nApplications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.\n\n### Patches\n\nUpgrade to `fast-uri` >= 3.1.1, or if you are in the v2.x release line, v2.4.1\n\n### Workarounds\n\nNone. Upgrade to the patched version.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "fast-uri"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.1.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.1.0"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "fast-uri"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.4.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.4.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-6321"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fast-uri/releases/tag/v3.1.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fast-uri/releases/tag/v2.4.1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/fastify/fast-uri"
  }, {
    "type" : "WEB",
    "url" : "https://cna.openjsf.org/security-advisories.html"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2466582"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-6321"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:57013"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:56928"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:56431"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:56366"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:42079"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:42078"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37385"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:34342"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26420"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26416"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26234"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26214"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:25123"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:25089"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:24977"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:24866"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:24766"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:24473"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:21338"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:20338"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:19238"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-08T17:15:09Z",
    "nvd_published_at" : "2026-05-04T20:16:20Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity High (I:H)

Availability None (A:N)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Advisory Metadata

Source ID: GHSA-q3j6-qgpj-74h6
Schema Version: 1.4.0
Published: 2026-05-08 17:15
Last Modified: 2026-08-20 15:33
Database Record File: advisories/github-reviewed/2026/05/GHSA-q3j6-qgpj-74h6/GHSA-q3j6-qgpj-74h6.json