Is CVE-2026-6321 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6321 being exploited in the wild.

How severe is CVE-2026-6321?

High severity, with a CVSS score of 7.5, published 4 May 2026.

Which products and versions are affected?

fast-uri (npm) SEMVER:introduced=3.0.0,fixed=3.1.1; Red Hat Developer Hub 1.8, 1.9.

Is there a fix for CVE-2026-6321?

Yes. fast-uri (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6321 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6321?

Check whether you run fast-uri (npm), Openjsf Fast-Uri or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6321: OpenJS Foundation fast-uri path traversal via percent-encoded dot segments

CVE-2026-6321 · Severity: high · CVSS 7.5 · Published 2026-05-04

fast-uri is a library used by web applications to handle and compare web addresses (URIs). A security flaw allows attackers to bypass security rules by using specially encoded characters that trick the system into accessing restricted areas. This could allow an attacker to reach administrative or private sections of a website that should otherwise be protected.

Technologies: fast-uri (npm), Red Hat Developer Hub. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-6321 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6321 being exploited in the wild.
How severe is CVE-2026-6321?: High severity, with a CVSS score of 7.5, published 4 May 2026.
Which products and versions are affected?: fast-uri (npm) SEMVER:introduced=3.0.0,fixed=3.1.1; Red Hat Developer Hub 1.8, 1.9.
Is there a fix for CVE-2026-6321?: Yes. fast-uri (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6321 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6321?: Check whether you run fast-uri (npm), Openjsf Fast-Uri or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-uri (npm): upgrade to 3.1.1 or later
```
npm install fast-uri@3.1.1
```

Technical details

The fast-uri library (v3.1.0 and earlier, and v2.4.0 and earlier) decodes percent-encoded path separators (%2F) and dot segments (%2E) before performing dot-segment removal in the normalize() and equal() functions. This logic error allows encoded sequences like '%2e%2e' to be treated as literal '..' during normalization. An attacker can exploit this to bypass path-based access control policies by providing a URI that appears to be within an allowed directory but resolves to a restricted path after normalization. The vulnerability is reachable over the network without authentication. Patches are available in versions 3.1.1 and 2.4.1.

Affected products

fastify fast-uri >= 3.0.0, <= 3.1.0
fastify fast-uri <= 2.4.0

Identifiers

CVE-2026-6321
GHSA-q3j6-qgpj-74h6

Timeline

2026-05-04: disclosed
2026-05-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.