Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110095— fast-uri vulnerable to improper path equivalence in relative reference normalization

Quick assessment

Affected
fast-uri fast-uri
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fast-uri 是一个无依赖的 Node.js RFC 3986 URI 解析器与序列化器。在 2.4.8 之前的版本、3.0.0 至 3.1.8 版本，以及 4.0.0 至 4.2.2 版本中， 和 函数会对相对路径引用的路径部分应用 RFC 3986 定义的“点段移除”（dot-segment removal）算法。然而，该算法仅适用于解析过程中合并后的目标路径，而非相对路径引用本身。因此，可能导致前导的父目录段（如 ）被错误移除，使原本为文档相对的路径引用变为根相对路径。若应用程序对攻击者或用户提供的相对路

CVSS 3.7 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110095

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fast-uri vulnerable to improper path equivalence in relative reference normalization
Source: CVE Program / CVE List V5
Vulnerability Description
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径等价的解析不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fast-uri fast-uri 0 ~ 2.4.8 -

II. Public POCs for CVE-2026-110095

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110095

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-110095 (1)

Same Patch Batch · fast-uri · 2026-10-20 · 4 CVEs total

CVE-2026-110306 6.1 MEDIUM fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
CVE-2026-110180 4.8 MEDIUM fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110725 3.7 LOW fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix ref

IV. Related Vulnerabilities

Same product: fast-uri
Same vendor: fast-uri
Same weakness: CWE-41

V. Comments for CVE-2026-110095

No comments yet

Leave a comment