Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-04 | 3 | General2Patch1 |
| 2026-05-05 | 1 | Disclosure1 |
| 2026-05-25 | 1 | Patch1 |
CVE-2026-6321 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was tr… https://www.cve.org/CVERecord?id=CVE-2026-6321
Post summary
CVE‑2026‑6321 involves an URI normalization flaw in fast‑uri, but the text offers no PoC, exploit details, known exploitation, patch info, or false‑positive claim.
🚨 High-severity security fix in fast-uri@3.1.1 just released! Patches CVE-2026-6321 — fast-uri vulnerable to path traversal via percent-encoded dot segments https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6
Post summary
Fastify released fast-uri 3.1.1 to patch CVE-2026-6321, a path traversal flaw involving percent‑encoded dot segments. The advisory provides the version and indicates a fix without detailing exploitation or PoC.
🚨 HIGH: CVE-2026-6321 (CVSS 7.5) fast-uri <=3.1.0 vulnerable to path traversal via percent-encoded separators. Attackers can bypass path-based security controls. Patch: Update to v3.1.1+ #CVE #Vulnerability #PatchNow https://t.co/vHYWxrJ02i
Post summary
CVE-2026-6321 is a path traversal flaw in fast‑uri <=3.1.0 that bypasses security controls; updating to 3.1.1+ patches the issue.
CVE-2026-6321 Path Traversal Vulnerability in fast-uri Versions 3.1.0 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6321
Post summary
The text announces a path traversal vulnerability in fast-uri 3.1.0 and earlier, with no provided exploit details, patch information, or evidence of active exploitation.
🚨*CVE* CVE-2026-6321 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was tr… https://www.cve.org/CVERecord?id=CVE-2026-6321 ----- Traducción: CVE-2026-6321 rut… http://infoflow.cloud`
Post summary
The post outlines technical aspects of CVE-2026-6321 regarding path decoding but does not mention PoCs, exploits, patches, or active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openjsf | fast-uri | - | node.js | - |