CVE-2026-110095: 
JavaScript vulnerability analysis and mitigation

CVE-2026-110095 is a path normalization flaw in fast-uri, a dependency-free RFC 3986 URI parser and serializer for Node.js, classified as improper path equivalence (CWE-41) and path traversal (CWE-22). The vulnerability affects all versions before 2.4.8, versions 3.0.0 through 3.1.8, and versions 4.0.0 through 4.2.2. It was published on October 20, 2026, with patches released the same day. The CVSS v3.1 base score is 3.7 (Low) (GitHub Advisory, Red Hat).

The root cause is that the normalize() and serialize() functions in fast-uri incorrectly apply RFC 3986's dot-segment removal algorithm (remove_dot_segments) to the path of a relative-path reference. Per RFC 3986 §5.2.4, this algorithm is defined only for the merged target path during URI resolution — not for the reference itself. When applied prematurely to a relative reference, leading .. segments are dropped, causing a document-relative reference to become root-relative (e.g., normalize('../x') returns x instead of ../x, and normalize('a/../b') returns /b). An application that normalizes an attacker-supplied relative reference and then resolves it — or uses it as a cache, deduplication, or authorization key — can have the reference escape its intended directory scope and point to a different resource (CWE-41, CWE-22) (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to supply a crafted relative URI reference that, after normalization and resolution by the application, bypasses directory restrictions and points to a different, unintended resource. The primary impact is an integrity bypass (Low) — specifically, manipulation of cache keys, deduplication logic, or authorization decisions — potentially allowing access to resources outside the intended authorization scope. There is no confidentiality or availability impact per the CVSS assessment, and exploitation requires high attack complexity (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as the attacker must supply a crafted relative URI that is processed through the vulnerable normalization path of the target application (GitHub Advisory).

1. Identify target application: Locate a Node.js application that uses a vulnerable version of fast-uri (< 2.4.8, 3.0.0–3.1.8, or 4.0.0–4.2.2) and accepts user- or attacker-supplied relative URI references as input.
2. Craft a malicious relative reference: Construct a relative URI containing leading dot-segments designed to traverse directories, such as ../secret or a/../../../admin.
3. Submit the crafted reference: Supply the malicious relative URI to the application via any input vector (e.g., HTTP request parameter, API field, form input) that feeds into the application's URI normalization or serialization logic.
4. Trigger normalization: The application calls normalize() or serialize() on the attacker-supplied reference, causing fast-uri to incorrectly strip the leading .. segments, transforming the reference into a root-relative path (e.g., ../secret becomes secret or /secret).
5. Achieve authorization bypass: The normalized (now altered) reference is resolved, used as a cache/deduplication key, or evaluated for authorization — pointing to a different resource than intended, potentially bypassing access controls or poisoning cache entries (GitHub Advisory).

Upgrade fast-uri to the patched versions: 2.4.8, 3.1.9, or 4.2.3 (or later), depending on the version branch in use. As a temporary workaround if upgrading is not immediately possible, resolve relative references against their absolute base URI first, then normalize the resulting absolute URI — do not normalize a relative reference before resolving it. No configuration-only mitigation is available (GitHub Advisory).

The advisory was published by maintainer mcollina on the Fastify GitHub repository, with UlisesGascon credited as remediation reviewer. Red Hat tracked the issue via Bugzilla (Bug #2556002) and published a corresponding CVE advisory. No significant broader media coverage or notable community commentary has been observed beyond standard vulnerability database aggregation (GitHub Advisory, Red Hat).