Threats tagged 'brew-uffizzi-cve-2026-126354'

Addressable versions 2.2.5 through 2.9.0 contain a URI normalization flaw where paths with certain '..' segments are incorrectly resolved, deviating from RFC 3986. This can cause an application that uses Addressable's normalized paths for allowlist checks but sends the original URI to other components to inadvertently allow access to unauthorized paths. The issue is fixed in version 2.9.1. Applications that use the same normalization for checks and requests or reject '..' segments are not affected.