Search: CVE-2026-110095

fast-uri versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2 contain a vulnerability in their normalize() and serialize() functions. These functions incorrectly apply RFC 3986 dot-segment removal to relative-path references, which can cause a leading parent-directory segment to be dropped. This flaw allows a relative reference to escape its intended directory and point to a different resource, potentially impacting cache, deduplication, or authorization mechanisms. The issue is fixed in versions 2.4.8, 3.1.9, and 4.2.3. Users should upgrade to these or later versions or apply the recommended workaround.