Path Traversal Vulnerability in Fast-uri for Node.js

CVE-2026-110095

What is CVE-2026-110095?

The fast-uri library, a dependency-free URI parser for Node.js, has a vulnerability in its normalize() and serialize() functions. Certain versions mishandle RFC 3986 dot-segment removal, leading to potential path traversal and unauthorized access to resources. Applications that process user-supplied relative-path references may inadvertently expose sensitive data or allow unauthorized operations. To secure your application, upgrade to fast-uri version 2.4.8, 3.1.9, or 4.2.3 or later. As a temporary measure, always resolve a relative reference against its absolute base before normalizing the result.

References