Threats tagged 'brew-licensee-cve-2026-126354'

Addressable versions 2.2.5 through 2.9.0 contain a URI normalization flaw where paths with multiple '..' segments are incorrectly resolved, deviating from RFC 3986. This can cause normalized paths to appear within an allowed directory while the original path actually points outside it, potentially enabling path traversal bypasses of allowlist checks. The issue is fixed in version 2.9.1. Applications that use Addressable's normalized path for access control but send the original URI to other components that resolve paths correctly are vulnerable. Rejecting paths with '..' segments or upgrading to 2.9.1 mitigates the issue.