Path Normalization Vulnerability in Fast URI by Fastify

CVE-2026-6321

What is CVE-2026-6321?

The vulnerability in Fast URI allows for the improper processing of percent-encoded path separators and dot segments. This can lead to the misrepresentation of distinct URIs, causing them to map to the same normalized path. As a result, certain applications that rely on URL normalization or comparison for enforcing security policies may inadvertently allow unauthorized access. It is crucial for users to update to version 3.1.1 or later to mitigate this risk.

References