UpHeron
All vulnerabilities

npm

CVE-2026-6321

fast-uri vulnerable to path traversal via percent-encoded dot segments

Severity
High 7.5
Published
8 May 2026
Last changed
10 Sept 2026
Added to UpHeron
22 Oct 2026
Fixed in
2.4.1, 3.1.1
Also known as
GHSA-q3j6-qgpj-74h6
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
fast-urinpm · osv:npm:fast-uri
  • Every version before 2.4.1
  • From 3.0.0 before 3.1.1

References