7.5
High
CVE-2026-6321 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize()…
Description
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| fast-uri 3.1 | earliest → < 3.1.1 | 3.1.1 |
| HawtIO HawtIO 4.4.0 | Versions not published | |
| Network Observability (NETOBSERV) 1.12.0 1780556069 | earliest → < 1780556069 | 1780556069 |
| Red Hat Ansible Automation Platform 2.5 1780082949 | earliest → < 1780082949 | 1780082949 |
| Red Hat Ansible Automation Platform 2.6 1779783248 | earliest → < 1779783248 | 1779783248 |
| Red Hat Developer Hub 1.8 1779841586 | earliest → < 1779841586 | 1779841586 |
| Red Hat Developer Hub 1.9 1781187342 | earliest → < 1781187342 | 1781187342 |
| Red Hat Discovery 2 1779395188 | earliest → < 1779395188 | 1779395188 |
| Red Hat OpenShift AI 2.25 1780467147 | earliest → < 1780467147 | 1780467147 |
Show the 33 other branches Hide the 33 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Dev Spaces 3.28 1780685176 | earliest → < 1780685176 | 1780685176 |
| Red Hat Openshift Data Foundation 4.16 1781184468 | earliest → < 1781184468 | 1781184468 |
| Red Hat Openshift Data Foundation 4.18 1786706880 | earliest → < 1786706880 | 1786706880 |
| Red Hat Openshift Data Foundation 4.18 1781557496 | earliest → < 1781557496 | 1781557496 |
| Red Hat Openshift Data Foundation 4.19 1786703143 | earliest → < 1786703143 | 1786703143 |
| Red Hat Openshift Data Foundation 4.19 1778577696 | earliest → < 1778577696 | 1778577696 |
| Red Hat Satellite 6.18 1781181673 | earliest → < 1781181673 | 1781181673 |
| Confidential Compute Attestation | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Cryostat 4 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Cluster Observability Operator 1.5.0 1782839494 | earliest → < 1782839494 | 1782839494 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Versions not published | |
| Network Observability (NETOBSERV) 1.12.1 1780556069 | earliest → < 1780556069 | 1780556069 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Openshift Data Foundation 4.2 1786629548 | earliest → < 1786629548 | 1786629548 |
| Red Hat Openshift Data Foundation 4.22 1787061554 | earliest → < 1787061554 | 1787061554 |
| Cluster Observability Operator 1.5.2 1782839494 | earliest → < 1782839494 | 1782839494 |
| Network Observability (NETOBSERV) 1.12.2 1780556069 | earliest → < 1780556069 | 1780556069 |
| Red Hat Openshift Data Foundation 4.20 1786629548 | earliest → < 1786629548 | 1786629548 |
References
- github.com github.com
- cna.openjsf.org cna.openjsf.org
Timeline
- Published
- Last modified
Other CVEs of fast-uri
The 17 CVEs of fast-uri →
CVE-2026-110725
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
3.7
Low
CVE-2026-110306
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
6.1
Medium
CVE-2026-110180
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
4.8
Medium
CVE-2026-110095
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js
3.7
Low