# CVE-2026-6321: OpenJS Foundation fast-uri path traversal via percent-encoded dot segments

Source: https://junglewise.ai/threats/cve-2026-6321-openjs-foundation-fast-uri-path-traversal-via-percent-encoded-dot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-08-10  
License: CC BY 4.0 with a link back

CVE-2026-6321 · Severity: high · CVSS 7.5 · Published 2026-05-04

fast-uri is a library used by web applications to handle and compare web addresses (URIs). A security flaw allows attackers to bypass security rules by using specially encoded characters that trick the system into accessing restricted areas. This could allow an attacker to reach administrative or private sections of a website that should otherwise be protected.

Technologies: [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri), [Red Hat Developer Hub](https://junglewise.ai/threats/technologies/developer-hub). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-6321 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6321 being exploited in the wild.

**How severe is CVE-2026-6321?** High severity, with a CVSS score of 7.5, published 4 May 2026.

**Which products and versions are affected?** fast-uri (npm) SEMVER:introduced=3.0.0,fixed=3.1.1; Red Hat Developer Hub 1.8, 1.9.

**Is there a fix for CVE-2026-6321?** Yes. fast-uri (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6321 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6321?** Check whether you run fast-uri (npm), Openjsf Fast-Uri or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-uri (npm): upgrade to 3.1.1 or later

  ```sh
  npm install fast-uri@3.1.1
  ```


## Technical details

The fast-uri library (v3.1.0 and earlier, and v2.4.0 and earlier) decodes percent-encoded path separators (%2F) and dot segments (%2E) before performing dot-segment removal in the normalize() and equal() functions. This logic error allows encoded sequences like '%2e%2e' to be treated as literal '..' during normalization. An attacker can exploit this to bypass path-based access control policies by providing a URI that appears to be within an allowed directory but resolves to a restricted path after normalization. The vulnerability is reachable over the network without authentication. Patches are available in versions 3.1.1 and 2.4.1.

## Affected products

- fastify fast-uri >= 3.0.0, <= 3.1.0
- fastify fast-uri <= 2.4.0

## Identifiers

- CVE-2026-6321
- GHSA-q3j6-qgpj-74h6

## Timeline

- 2026-05-04: disclosed
- 2026-05-08: advisory

## References

- [https://api.github.com/users/Jvr2022](https://api.github.com/users/Jvr2022)
- [https://github.com/Jvr2022](https://github.com/Jvr2022)
- [https://api.github.com/users/Jvr2022/gists%7B/gist_id%7D](https://api.github.com/users/Jvr2022/gists%7B/gist_id%7D)
- [https://api.github.com/users/Jvr2022/repos](https://api.github.com/users/Jvr2022/repos)
- [https://avatars.githubusercontent.com/u/109031036?v=4](https://avatars.githubusercontent.com/u/109031036?v=4)
- [https://api.github.com/users/Jvr2022/events%7B/privacy%7D](https://api.github.com/users/Jvr2022/events%7B/privacy%7D)

## Related threats

- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri URI scheme spoofing via percent-encoded scheme](https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri host confusion via unchecked WHATWG canonicalization](https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri mailto header injection via percent-encoded field-name desynchronization](https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name)