CVE-2026-110095

What it actually does

The normalize() and serialize() functions incorrectly apply RFC 3986 dot-segment removal to relative-path references, allowing a leading '../' segment to be dropped so that a document-relative reference becomes root-relative and can escape its intended directory scope when later resolved or used as a cache/deduplication/authorization key.

Why it matters to the business

Applications that normalize attacker- or user-supplied relative references before resolution or use them for access decisions may grant unintended access to different resources, increasing risk of unauthorized data exposure or authorization bypass; low urgency given no KEV listing and modest EPSS score with only slight recent increase.

How an attack unfolds

An attacker supplies a crafted relative reference containing leading parent-directory segments to an application endpoint that passes it to fast-uri normalize() or serialize(); the flawed dot-segment removal drops the leading '../', converting the reference into a root-relative path; the resulting value is then used for caching, deduplication, or authorization, allowing the attacker to reach a resource outside the intended directory.

How to fix it

Upgrade fast-uri to version 2.4.8, 3.1.9, or 4.2.3 or later. If immediate upgrade is not possible, resolve the relative reference against its absolute base URI first and normalize only the absolute result.

How to confirm the fix worked

Verify the installed fast-uri version in package.json or node_modules meets or exceeds 2.4.8 / 3.1.9 / 4.2.3; test that normalize() on a relative reference such as '../secret' no longer strips the leading segment when the reference is later resolved against a base.

Typical attack path

1. Identify application code paths that accept relative URI references and pass them to fast-uri normalize() or serialize()
2. Craft a relative reference beginning with '../' that targets a resource outside the intended scope
3. Submit the reference so that normalization occurs before absolute resolution or key usage
4. Observe or leverage the resulting root-relative reference to access unauthorized resources

How to detect it

Review application source and dependency trees for use of fast-uri normalize or serialize on user-controlled relative references; inspect logs or audit trails for unexpected root-relative URIs appearing after normalization of relative inputs.

What your security team should do

• Upgrade fast-uri to a fixed version (2.4.8, 3.1.9, or 4.2.3) across all Node.js projects
• Audit application code for direct calls to normalize() or serialize() on untrusted relative references and apply the absolute-resolution workaround where upgrade is delayed
• Add dependency scanning to CI pipelines to prevent future vulnerable fast-uri versions from being introduced