fast-uri vulnerable to path traversal via percent-encoded dot segments
Priority MEDIUM 40CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 22 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00634 50th percentileScored 2026-11-07
Fix Partial fast-uri (fast-uri): 3.1.1fast-uri (npm): 3.1.1, 2.4.1Red Hat: 24 advisoriesRed Hat: 22 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fast-uri | fast-uri | before 3.1.1 | 3.1.1 | Patch available | CNA |
| — | fast-uri (npm) | 3.0.0 to before 3.1.1 | 3.1.1 | Patch available | GHSA-q3j6-qgpj-74h6 |
| — | fast-uri (npm) | before 2.4.1 | 2.4.1 | Patch available | GHSA-q3j6-qgpj-74h6 |
- fast-uri Vendorfast-uri Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
- fast-uri (npm) Vendor— Affected 3.0.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-q3j6-qgpj-74h6
- fast-uri (npm) Vendor— Affected before 2.4.1 Fixed in 2.4.1 Patch available GHSA-q3j6-qgpj-74h6
Remediation
- Fix · CNA fast-uri (fast-uri) Fixed in 3.1.1
- Fix · GHSA-q3j6-qgpj-74h6 fast-uri (npm) Fixed in 3.1.1 Advisory →
- Fix · GHSA-q3j6-qgpj-74h6 fast-uri (npm) Fixed in 2.4.1 Advisory →
Red Hat 24 advisories
- RHSA-2026:83622 Released 2026-10-15 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:57013 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
Show 21 more Red Hat advisories
- RHSA-2026:56928 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:56366 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:42079 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 ansible-core-2:2.16.19-1.el10ap, receptor-1.6.6-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, automation-controller-venv-tower-4.7.14-3.el9ap, automation-gateway-proxy-2.6.17-1.el9ap +5
- RHSA-2026:42078 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
- RHSA-2026:37385 Released 2026-07-09 · Red Hat rating Importantrh-podman-desktop security advisory update
- Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.1-1.el10_2
- RHSA-2026:34342 Released 2026-07-01 · Red Hat rating CriticalCluster Observability Operator 1.5.0
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
- RHSA-2026:26420 Released 2026-06-16 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:26416 Released 2026-06-16 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.30 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
- RHSA-2026:26234 Released 2026-06-16 · Red Hat rating ImportantRed Hat Developer Hub 1.9.5 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:26214 Released 2026-06-16 · Red Hat rating ImportantGeneral availability of the satellite/iop-advisor-frontend-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
- RHSA-2026:26068 Released 2026-06-15 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:25123 Released 2026-06-10 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.28.2 Release.
- Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9, registry.redhat.io/devspaces/pluginregistry-rhel9 +1
- RHSA-2026:25089 Released 2026-06-10 · Red Hat rating ImportantHawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.
- HawtIO HawtIO 4.4.0
- RHSA-2026:24977 Released 2026-06-10 · Red Hat rating ImportantRHOAI 2.25.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +34
- RHSA-2026:24866 Released 2026-06-09 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +7
- RHSA-2026:24766 Released 2026-06-09 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8
- RHSA-2026:24473 Released 2026-06-08 · Red Hat rating ImportantNetwork Observability 1.12.0 for OpenShift
- Network Observability (NETOBSERV) 1.12.3 registry.redhat.io/network-observability/network-observability-console-plugin-pf4-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9, registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9
- RHSA-2026:21338 Released 2026-05-27 · Red Hat rating ImportantRed Hat Developer Hub 1.8.7 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:20338 Released 2026-05-21 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:19238 Released 2026-05-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.16 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Build of Podman Desktop - Tech Preview | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Developer Hub 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:34342 |
| HawtIO HawtIO 4.4.0 | Fixed | RHSA-2026:25089 |
| Network Observability (NETOBSERV) 1.12.3 | Fixed | RHSA-2026:24473 |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:24766 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:24866 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:42079 |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2026:21338 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:26234 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:20338 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Fixed | RHSA-2026:37385 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:24977 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift Dev Spaces 3.28 | Fixed | RHSA-2026:25123 |
| Red Hat Openshift Data Foundation 4.16 | Fixed | RHSA-2026:26416 |
| Red Hat Openshift Data Foundation 4.17 | Fixed | RHSA-2026:83622 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:26420, RHSA-2026:56431 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:19238, RHSA-2026:56366 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2026:57013 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:56928 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:26214 |
Not affected: 29 products
- Cluster Observability Operator 1.5
- Cryostat 4
- Network Observability (NETOBSERV) 1.12.3
- OpenShift Pipelines
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Developer Hub 1.8
- Red Hat Developer Hub 1.9
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces 3.28
- Red Hat Openshift Data Foundation 4.16
- Red Hat Openshift Data Foundation 4.17
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.19
- Red Hat Openshift Data Foundation 4.20
- Red Hat Openshift Data Foundation 4.22
- Red Hat Satellite 6
- streams for Apache Kafka 2
- streams for Apache Kafka 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6321
- 2026-10-03 Alias added: GHSA-q3j6-qgpj-74h6
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83622 · Red Hat
- 2026-10-16 Fix available: Red Hat Openshift Data Foundation 4.17 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
References
Advisory 3
Other 27
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json
- https://github.com/fastify/fast-uri/releases/tag/v3.1.1
- https://github.com/fastify/fast-uri/releases/tag/v2.4.1
- https://github.com/fastify/fast-uri
- https://bugzilla.redhat.com/show_bug.cgi?id=2466582
- https://access.redhat.com/security/cve/CVE-2026-6321
- https://access.redhat.com/errata/RHSA-2026:57013
- https://access.redhat.com/errata/RHSA-2026:56928
- https://access.redhat.com/errata/RHSA-2026:56431
- https://access.redhat.com/errata/RHSA-2026:56366
- https://access.redhat.com/errata/RHSA-2026:42079
- https://access.redhat.com/errata/RHSA-2026:42078
- https://access.redhat.com/errata/RHSA-2026:37385
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:26420
- https://access.redhat.com/errata/RHSA-2026:26416
- https://access.redhat.com/errata/RHSA-2026:26234
- https://access.redhat.com/errata/RHSA-2026:26214
- https://access.redhat.com/errata/RHSA-2026:25123
- https://access.redhat.com/errata/RHSA-2026:25089
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:24866
- https://access.redhat.com/errata/RHSA-2026:24766
- https://access.redhat.com/errata/RHSA-2026:24473
- https://access.redhat.com/errata/RHSA-2026:21338
- https://access.redhat.com/errata/RHSA-2026:20338
- https://access.redhat.com/errata/RHSA-2026:19238
More Fast-uri vulnerabilities
- TI-2026-11539 fast-uri vulnerable to host confusion via failed IDN canonicalization CVSS 3.1HIGH 7.5
- TI-2026-58005 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority CVSS 3.1HIGH 7.5
- TI-2026-53157 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references CVSS 3.1HIGH 7.5
- TI-2026-15158 fast-uri vulnerable to host confusion via backslash authority introducer CVSS 3.1HIGH 7.5
- TI-2026-13562 fast-uri vulnerable to host confusion via literal backslash authority delimiter CVSS 3.1HIGH 7.5
- TI-2026-05546 fast-uri vulnerable to host confusion via percent-encoded authority delimiters CVSS 3.1HIGH 7.5
Sources
- CVE-2026-6321 · CVE Program
- CVE-2026-6321 · NVD
- FIRST EPSS
- GHSA-q3j6-qgpj-74h6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-6321 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences