CVE-2026-110095

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.8 fast-uri versions 3.0.0 through 3.1.8 fast-uri versions 4.0.0 through 4.2.2

Description The normalize() and serialize() functions incorrectly apply RFC 3986 dot-segment removal to the path of a relative-path reference. This algorithm is intended only for the merged target path during resolution. Consequently, a leading parent-directory segment may be dropped, causing a document-relative reference to become root-relative. Applications that normalize user-supplied relative references before resolution or use them as cache, deduplication, or authorization keys may allow the reference to escape its intended directory and access a different resource.

Recommendations Update to version 2.4.8 or later. Update to version 3.1.9 or later. Update to version 4.2.3 or later. As a temporary workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.