CVE-2026-110095

About vulnerability

Impact

fast-uri’s normalize() and serialize() apply RFC 3986 dot-segment removal (remove_dot_segments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one.

For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)) points at a different resource than resolve(base, ref), and equal() treats distinct references as the same.

Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.

Patches

Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.

Workarounds

Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.

Affected product:

@mcp-ui/client , @mcp-ui/server , AngularJS , CopilotKit/CopilotKit , Fastify , Lodash , Next.js , Node.js , React , TanStack/ai , Vue , adk-js , adobe-design-data , adobe-design-data-agent-mcp , adobe-design-data-mcp , adobe-spectrum-design-data-mcp , aegir , ag-ui , ag-ui-aws-strands , agents , ai-sdk-harness-cline , ai-sdk-harness-pi , ai-sdk-provider-claude-code , ai-sdk-workflow , ajv , ajv-compiler , ajv-draft-04 , ajv-errors , ajv-formats , ajv-formats-draft2019 , ajv-i18n , ajv-keywords , algokit-utils-ts , allure-codeceptjs , analogjs-astro-angular , analogjs-storybook-angular , analogjs-vite-plugin-angular , analogjs-vitest-angular , angular-build , angular-create , angular-devkit-architect-cli , angular-devkit-build-angular , angular-devkit-build-webpack , angular-devkit-core , angular-devkit-schematics-cli , angular-eslint , angular-eslint-builder , angular-eslint-schematics , angular-pwa , api-extractor-model , apideck-better-ajv-errors , apify-input_schema , apify-json_schemas , apollo , apollo-server-fastify , appium , appium-execute-driver-plugin , appium-fake-driver , appium-fake-plugin , appium-relaxed-caps-plugin , arcjet-js , arizeai-openinference-instrumentation-beeai , as-integrations-fastify , astrojs-check , astrojs-netlify , automatic-vendor-sharing , awesome-ajv-errors , aws-cdk , azion , babel-eslint , babel-eslint-parser , babel-loader , babel-plugin-remove-graphql-queries , beeai-framework , better-ajv-errors , blockchain-link-utils , braintrust-openai-agents , braintrust-otel , braintrust-sdk-javascript , braintrust-temporal , browserbasehq-stagehand , bufbuild/connect-es , bundle-stats , cache-loader , callstack-repack , callstack-repack-plugin-expo-modules , callstack-repack-plugin-nativewind , callstack-repack-plugin-reanimated , claude-agent-sdk-typescript , clawdbot-lobster , clean-webpack-plugin , clerk-fastify , cline , cline-sdk , cloud-sdk-js , cloudevents , cloudflare-ai-chat , cloudflare-codemode , cloudflare-think , cloudflare-voice , cloudflare-voice-twilio , cloudflare/agents , codeceptjs , coffee-loader , commitlint , commitlint-cli , commitlint-core , commitlint-cz-commitlint , commitlint-load , commitlint-prompt , commitlint-prompt-cli , commitlint-travis-cli , composio , composio-anthropic , composio-claude-agent-sdk , conf , config , configure , confluent-kafka-javascript , connect-es , connectrpc-connect-fastify , copilotkit-agentcore-runner , copilotkit-mcp-apps-renderer , copilotkit-react-native , copilotkit-react-textarea , copilotkit-react-ui , copilotkit-runtime , copilotkit-sqlite-runner , copilotkit-voice , copilotkit-vue , copy-webpack-plugin , create-react-app , css-loader , css-minimizer-webpack-plugin , csstools-stylelint-no-invalid-at-import-rules-when-bundling , cyclonedx-cyclonedx-library , cypress-webpack-preprocessor , cz-cli , cz-conventional-changelog , definitelytyped , docsearch , docusaurus , docusaurus-babel , docusaurus-bundler , docusaurus-core , docusaurus-mdx-loader , docusaurus-module-type-aliases , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , docusaurus-types , docusaurus-utils , docusaurus-utils-common , docusaurus-utils-validation , dotenvx-dotenvx , dxup-nuxt , earendil-works-pi-agent-core , earendil-works-pi-ai , ecosystem , electron-store , electron-webpack-js , ember-auto-import , ember.js , envelop-graphql-jit , esbuild-loader , eslint , eslint-community/eslint-utils , eslint-config-ipfs , eslint-config-love , eslint-config-prettier , eslint-config-react-app , eslint-config-standard , eslint-etc , eslint-loader , eslint-mcp , eslint-plugin-deprecation , eslint-plugin-es , eslint-plugin-etc , eslint-plugin-flowtype , eslint-plugin-import , eslint-plugin-jest , eslint-plugin-jsdoc , eslint-plugin-jsx-a11y , eslint-plugin-node , eslint-plugin-promise , eslint-plugin-react , eslint-plugin-react-hooks , eslint-plugin-simple-import-sort , eslint-plugin-testing-library , eslint-utils , eslint-webpack-plugin , executor , executor-js-codemode-core , executor-js-execution , executor-js-plugin-mcp , executor-js-runtime-quickjs , expo , expo-build-properties , expo-constants , expo-dev-client , expo-dev-launcher , expo-dev-tools , expo-expo-cli , expo-localization , expo-module-scripts , expo-next-adapter , expo-router , expo-router-server , expo-schemer , expo-splash-screen , expo-webpack-config , ext-apps , extract-css-chunks-webpack-plugin , fast-json-stringify , fast-json-stringify-compiler , fast-uri , file-loader , filecoin , files-sdk , forge , fork-ts-checker-webpack-plugin , friendly-errors-webpack-plugin , fumadocs , fumadocs-ai-chat , fumadocs-graphql , fumadocs-openapi , fumadocs-ui , fumapress , fumapress-ai , fumapress-feedback , fumapress-graphql , fumapress-mintlify , gateway , gatsby , gatsby-plugin-compile-es6-packages , gatsby-plugin-fathom , gatsby-plugin-page-creator , gatsby-plugin-react-helmet , gatsby-plugin-sharp , gatsby-source-filesystem , google-adk , google-cloud-functions-framework , google-cloud-vertexai , graphql-codegen-typescript-jit-sdk , graphql-hive-gateway , graphql-jit , graphql-mesh , graphql-mesh-cli , graphql-mesh-config , graphql-mesh-http , graphql-mesh-json-schema , graphql-mesh-migrate-config-cli , graphql-mesh-openapi , graphql-mesh-plugin-jit , graphql-mesh-raml , graphql-mesh-runtime , graphql-mesh-urql-exchange , gutenberg , hard-source-webpack-plugin , harness-sdk , hooks , html-loader , html-webpack-plugin , html-webpack-skip-assets-plugin , html-webpack-tags-plugin , imports-loader , impound , iso-kv , iso-repo , jest-expect-jsonschema , jest-expect-openapi , jest-expo , js-genai , json-render-mcp , json-schema-resolver , language-server , leafygreen-ui , ledger-cosmos-js , ledger-live , ledgerhq-hw-app-near , ledgerhq-live-cli , ledgerhq-live-common , less-loader , lg-tools-storybook-addon , libp2p-interfaces-compliance-tests , light-my-request , lighthouse , lit-labs-nextjs , loaders.gl-tile-converter , lynx-js-config-rsbuild-plugin , lynx-js-css-extract-webpack-plugin , lynx-js-docs-mcp-server , lynx-js-genui , lynx-js-qrcode-rsbuild-plugin , lynx-js-react-alias-rsbuild-plugin , lynx-js-react-rsbuild-plugin , lynx-js-rsbuild-plugin , lynx-js-rspeedy , mastra , mastra-blaxel , mastra-braintrust , mastra-client-js , mastra-code-sdk , mastra-core , mastra-factory , mastra-files-sdk , mastra-github-signals , mastra-hono , mastra-longmemeval , mastra-mcp , mastra-mcp-docs-server , mastra-observability , mastra-openai , mastra-opencode , mastra-parallel , mastra-playground-ui , mastra-react , mastra-server-adapters-test-suite , mastra-slack , mastra-tavily , mastra-temporal , mastracode , mdx , mercurius , mercurius-federation , mercuriusjs-gateway , metamask-core , metamask-snaps-cli , microsoft-365-agents-toolkit , microsoft-api-documenter , microsoft-rush , microsoft-rush-lib , middleware , middy , mini-css-extract-plugin , minimizer-webpack-plugin , modelcontextprotocol-ext-apps , modern-js-adapter-rstest , modern-js-app-tools , modern-js-builder , modern-js-plugin-bff , modern-js-render , modern-js-rsbuild-plugin-esbuild , modern-js-runtime , modern-js-uni-builder , modern.js , module-federation-core , module-federation-devtools , module-federation-enhanced , module-federation-modern-js , module-federation-nextjs-mf , module-federation-rsbuild-plugin , module-federation-storybook-addon , module-federation-typescript , module-federation/core , moment-locales-webpack-plugin , mongodb-js-dl-center , mongodb-js-node-webpack-startup-snapshot-checker , mui-mcp , mui-x , mui-x-charts-premium , mui-x-charts-pro , mui-x-data-grid-generator , mui-x-data-grid-premium , mui-x-data-grid-pro , mui-x-date-pickers-pro , mui-x-license , mui-x-telemetry , mui-x-tree-view-pro , near-api-js , nestjs-cls , nestjs-mercurius , nestjs-platform-fastify , netlify-build , netlify-cms , netlify-cms-app , netlify-cms-core , netlify-dev , netlify-edge-bundler , netlify-edge-functions , netlify-framework-info , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , ng-packagr , ngtools-webpack , nitro , npm:@near-js/wallet-account , null-loader , nuxt , nuxt-devtools , nuxt-devtools-kit , nuxt-devtools-ui-kit , nuxt-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , nx , nx-angular , nx-angular-rspack , nx-angular-rspack-compiler , nx-detox , nx-expo , nx-module-federation , nx-nest , nx-next , nx-react , nx-react-native , nx-rspack , nx-vite , nx-vue , nx-web , nx-webpack , oas , oas-normalize , octanejs-docusaurus , octanejs-mcp-server , office-addin-debugging , office-addin-dev-settings , office-addin-manifest , office-addin-scripts , omnigraph-json-schema , omnigraph-openapi , open-wc-building-rollup , openai-agents , openai-agents-extensions , openai-agents-js , openai-agents-openai , openai-agents-realtime , openapi-response-validator , openapi-schema-validator , openuidev-lang-core , optimize-css-assets-webpack-plugin , orama-orama , orval , panda , pandacss-dev , pandacss-mcp , pandacss-node , pandacss-postcss , pandacss-reporter , parcel , percy-cli , percy-cli-app , percy-cli-build , percy-cli-command , percy-cli-config , percy-cli-doctor , percy-cli-exec , percy-cli-snapshot , percy-cli-upload , percy-client , percy-core , percy-monitoring , percy-webdriver-utils , pi , pi-mcp-adapter , pinecone-database-pinecone , pkg-utils , pkgs , pnpm , pnpm-auth.commands , pnpm-cache.commands , pnpm-cli.commands , pnpm-config.commands , pnpm-deps.compliance.sbom , pnpm-deps.inspection.commands , pnpm-engine.pm.commands , pnpm-engine.runtime.commands , pnpm-pkg-manifest.commands , pnpm-registry-access.commands , pnpm-releasing.commands , pnpm-store.commands , pnpm-workspace.commands , postcss-loader , posthog-webpack-plugin , powersync-nuxt , powertools-lambda-typescript , prefresh-webpack , primitives , prisma , prisma-client , progress-bar-webpack-plugin , progress-webpack-plugin , purgecss-webpack-plugin , raw-loader , readme-better-ajv-errors , readme-oas-to-har , readme-openapi-parser , redocly-ajv , redocly-cli , redocly-client-generator , redocly-openapi-core , redocly-recheck , redocly-respect-core , redocly-reunite-integration , remotion-babel-loader , remotion-bundler , remotion-cli , remotion-cloudrun , remotion-enable-scss , remotion-lambda , remotion-mcp , remotion-serverless , remotion-studio-server , remotion-tailwind , remotion-tailwind-v4 , render-help , repack , rock-js-plugin-repack , rollup-plugin-workbox , rsbuild , rsbuild-core , rsbuild-plugin-css-minimizer , rsbuild-plugin-type-check , rsbuild-plugin-vue , rsdoctor , rsdoctor-core , rsdoctor-docs , rsdoctor-graph , rsdoctor-rspack-plugin , rsdoctor-sdk , rsdoctor-types , rsdoctor-utils , rsdoctor-webpack-plugin , rspack-cli , rspack-dev-server , rspack-test-tools , rspress , rushstack , rushstack-debug-certificate-manager , rushstack-eslint-config , rushstack-hashed-folder-copy-plugin , rushstack-heft-config-file , rushstack-heft-dev-cert-plugin , rushstack-heft-isolated-typescript-transpile-plugin , rushstack-heft-jest-plugin , rushstack-heft-lint-plugin , rushstack-heft-localization-typings-plugin , rushstack-heft-node-rig , rushstack-heft-rspack-plugin , rushstack-heft-sass-load-themed-styles-plugin , rushstack-heft-sass-plugin , rushstack-heft-serverless-stack-plugin , rushstack-heft-static-asset-typings-plugin , rushstack-heft-storybook-plugin , rushstack-heft-typescript-plugin , rushstack-heft-vscode-extension-plugin , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-heft-webpack5-plugin , rushstack-localization-utilities , rushstack-lockfile-explorer , rushstack-npm-check-fork , rushstack-operation-graph , rushstack-package-extractor , rushstack-playwright-browser-tunnel , rushstack-rundown , rushstack-rush-amazon-s3-build-cache-plugin , rushstack-rush-azure-storage-build-cache-plugin , rushstack-rush-bridge-cache-plugin , rushstack-rush-cli-client , rushstack-rush-http-build-cache-plugin , rushstack-rush-published-versions-json-plugin , rushstack-rush-redis-cobuild-plugin , rushstack-rush-sdk , rushstack-rush-serve-plugin , rushstack-stream-collator , rushstack-terminal , rushstack-trace-import , rushstack-typings-generator , rushstack-webpack-embedded-dependencies-plugin , rushstack-webpack-plugin-utilities , rushstack-webpack-workspace-resolve-plugin , rushstack-webpack4-localization-plugin , rushstack-webpack5-localization-plugin , rushstack-webpack5-module-minifier-plugin , rushstack-zipsync , rxdb , sanity-tsdown-config , sass-loader , scalar , scalar-asyncapi-validator , scalar-docusaurus , scalar-openapi-parser , scalar-openapi-validator , scalar/scalar , schema-utils , schematics , schematics-angular , sdk-typescript , secretlint , secretlint-config-loader , secretlint-core , secretlint-formatter , secretlint-node , secretlint-quick-start , secretlint-secretlint-rule-pattern , secretlint-tester , sentry-ember , sentry-gatsby , sentry-javascript , sentry-javascript-bundler-plugins , sentry-nextjs , sentry-webpack-plugin , serve , services , shadcn , shadcn-registry , sidvind-better-ajv-errors , silverbucket/ajv-formats-draft2019 , size-limit-preset-big-lib , size-limit-webpack , size-limit-webpack-css , size-limit-webpack-why , size-plugin , soda-friendly-errors-webpack-plugin , source-map-loader , statoscope , storybook , storybook-addon-webpack5-compiler-swc , storybook-angular , storybook-angular-vite , storybook-builder-webpack5 , storybook-core , storybook-core-client , storybook-core-common , storybook-core-server , storybook-ember , storybook-html-webpack5 , storybook-nextjs , storybook-preact-webpack5 , storybook-preset-create-react-app , storybook-preset-html-webpack , storybook-preset-react-webpack , storybook-preset-vue3-webpack , storybook-react , storybook-react-webpack5 , storybook-server-webpack5 , storybook-svelte-webpack5 , storybook-telemetry , storybook-vue3-webpack5 , storybook-web-components-webpack5 , strapi-admin , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-core , strapi-data-transfer , strapi-database , strapi-email , strapi-i18n , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-review-workflows , strapi-strapi , strapi-types , strapi-upload , streams , string-replace-loader , stryker-mutator-core , stryker-mutator-typescript-checker , stryker-mutator-vitest-runner , style-loader , style-resources-loader , stylelint , stylelint-config-recess-order , stylelint-config-recommended , stylelint-config-recommended-scss , stylelint-config-sass-guidelines , stylelint-no-unsupported-browser-features , stylelint-order , stylelint-scss , stylelint-stylistic , svg-url-loader , swagger-api-apidom-ls , swagger-parser , swc-node-loader , table , tailwindcss-webpack , tanstack-ai , tanstack-ai-acp , tanstack-ai-claude-code , tanstack-ai-codex , tanstack-ai-grok-build , tanstack-ai-mcp , tanstack-ai-opencode , tanstack-ai-sandbox , tanstack-ai-sandbox-blaxel , tanstack-ai-sandbox-boxd , tanstack-ai-sandbox-cloudflare , tanstack-ai-sandbox-daytona , tanstack-ai-sandbox-local-process , tanstack-ai-sandbox-railway , tanstack-ai-sandbox-sprites , tanstack-ai-sandbox-vercel , tanstack-rxdb-db-collection , telemetry , temporalio-google-adk-agents , temporalio-lambda-worker , temporalio-nyc-test-coverage , temporalio-testing , temporalio-worker , textlint-linter-formatter , thread-loader , time-fix-plugin , transloadit-mcp-server , trezor-connect-web , trezor-env-utils , trezor-suite , ts-command-line , ts-loader , tsdoc , tsrx-mcp , tty-table , typescript-eslint , typescript-eslint-eslint-plugin , typescript-eslint-parser , typescript-eslint-type-utils , typescript-sdk , unctx , unhead , unhead-bundler , unhead-vue , unimport , unocss , unocss-nuxt , unocss-webpack , unplugin , url-loader , vercel-client , vercel-microfrontends , verdaccio , verdaccio-api , verdaccio-audit , verdaccio-auth , verdaccio-auth-memory , verdaccio-aws-s3-storage , verdaccio-cli , verdaccio-core , verdaccio-loaders , verdaccio-local-storage , verdaccio-local-storage-legacy , verdaccio-logger , verdaccio-node-api , verdaccio-package-filter , verdaccio-plugin-verifier , verdaccio-proxy , verdaccio-search , verdaccio-server , verdaccio-signature , verdaccio-store , verdaccio-tarball , verdaccio-test-helper , verdaccio-url , verdaccio-utils , verdaccio-web , vite-plugin-react , waku , wallet-adapter , wdio-devtools-backend , wdio-devtools-service , wdio-lighthouse-service , webdriverio/devtools , webpack , webpack-assets-manifest , webpack-cli , webpack-cli-configtest , webpack-cli-generators , webpack-cli-info , webpack-cli-serve , webpack-dev-middleware , webpack-dev-server , webpack-filter-warnings-plugin , webpack-manifest-plugin , webpack-plugin-ramdisk , webpack-plugin-serve , webpack-subresource-integrity , webpackbar , wordpress-abilities , wordpress-core-abilities , wordpress-dependency-extraction-webpack-plugin , wordpress-e2e-test-utils-playwright , wordpress-env , wordpress-eslint-plugin , wordpress-readable-js-assets-webpack-plugin , wordpress-scripts , wordpress-stylelint-config , workbox , worker-loader , wp-playground-blueprints , wp-playground-cli , wp-playground-mcp , wp-playground-tools , wyw-in-js , wyw-in-js-webpack-loader , x402 , x402-express , x402-extensions , x402-fastify , x402-hono , x402-mcp , x402-next , x402-paywall , xdl , xhd-wallet-api-ts , yaml-language-server , zbsearch-plugin-docusaurus , zephyr-modernjs-plugin , zephyr-repack-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

fast-uri @ 2.4.0 (+7887 more)