Executive brief
fast-uri is a library used by web applications to handle and compare web addresses (URIs). A security flaw allows attackers to bypass security rules by using specially encoded characters that trick the system into accessing restricted areas. This could allow an attacker to reach administrative or private sections of a website that should otherwise be protected.
Technical details
The fast-uri library (v3.1.0 and earlier, and v2.4.0 and earlier) decodes percent-encoded path separators (%2F) and dot segments (%2E) before performing dot-segment removal in the normalize() and equal() functions. This logic error allows encoded sequences like '%2e%2e' to be treated as literal '..' during normalization. An attacker can exploit this to bypass path-based access control policies by providing a URI that appears to be within an allowed directory but resolves to a restricted path after normalization. The vulnerability is reachable over the network without authentication. Patches are available in versions 3.1.1 and 2.4.1.
Affected products
- fastify fast-uri >= 3.0.0, <= 3.1.0
- fastify fast-uri <= 2.4.0
Timeline
- 2026-05-04: disclosed
- 2026-05-08: advisory