Skip to content
Fencer Intel
high 7.5

CVE-2026-6321 json

fast-uri vulnerable to path traversal via percent-encoded dot segments

published 6mo ago modified 5h ago also EUVD-2026-27129 , GHSA-q3j6-qgpj-74h6

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

Patch / fix

  • npm fast-uri 2.4.1, 3.1.1
  • fast-uri fast-uri 3.1.1
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20260715-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20260715-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.11-1.el9ap
  • Red Hat Red Hat Enterprise Linux 10 0:1.1.1-1.el10_2
  • Red Hat Cluster Observability Operator 1.5.0 1782838476, 1782838753, 1782839193, 1782839279, 1782839494, 1782839981, 1782839996, 1782840519, 1782840539, 1782841925
  • Red Hat Network Observability (NETOBSERV) 1.12.2 1780556069
  • Red Hat Red Hat Ansible Automation Platform 2.5 1780082949
  • Red Hat Red Hat Ansible Automation Platform 2.6 1779783248, 1779784904
  • Red Hat Red Hat Developer Hub 1.8 1779841586
  • Red Hat Red Hat Developer Hub 1.9 1781187342
  • Red Hat Red Hat Discovery 2 1779395188
  • Red Hat Red Hat OpenShift AI 2.25 1780467029, 1780467147
  • Red Hat Red Hat Openshift Data Foundation 4.16 1780663368, 1780663548, 1780663596, 1780663638, 1780663861, 1780663886, 1780663920, 1780664089, 1780664140, 1781183284, 1781183499, 1781183713, 1781183811, 1781184121, 1781184239, 1781184468, 1781184484, 1781184611
  • Red Hat Red Hat Openshift Data Foundation 4.18 1781554936, 1781555645, 1781555679, 1781555708, 1781555717, 1781556009, 1781556534, 1781557189, 1781557202, 1781558423, 1786705347, 1786705558, 1786705646, 1786705741, 1786705777, 1786705802, 1786705938, 1786706101, 1786706138, 1786706577
  • Red Hat Red Hat Openshift Data Foundation 4.19 1778576350, 1778576707, 1778576929, 1778576957, 1778577083, 1778577150, 1778577175, 1778769574, 1778770148, 1779093256, 1786701555, 1786701839, 1786702052, 1786702264, 1786702276, 1786702315, 1786702440, 1786702448, 1786702559, 1786702713
  • Red Hat Red Hat Openshift Data Foundation 4.20 1786626399, 1786627106, 1786627382, 1786627430, 1786627460, 1786627469, 1786627559, 1786628053, 1786628142, 1786628235, 1786628340, 1786628623, 1786629076, 1786629478, 1786629761, 1786631508, 1786632256, 1786644072, 1786687918, 1786688215
  • Red Hat Red Hat Openshift Data Foundation 4.22 1787057250, 1787057603, 1787057849, 1787057964, 1787057989, 1787058278, 1787058403, 1787058450, 1787058588, 1787058658, 1787058706, 1787058807, 1787058970, 1787059072, 1787059085, 1787059538, 1787059616, 1787059853, 1787060257, 1787061098
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 1780685176
  • Red Hat Red Hat Satellite 6.18 1781181673
  • node-ajv Debian 14 8.20.0~ds+~cs6.1.3-1

debian advisories DEBIAN-CVE-2026-6321

  • receptor ansible automation platform 2.6 1.6.6-1.el10ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.6-1.el9ap
  • ansible-core ansible automation platform developer 2.6, ansible automation platform 2.6 2:2.16.19-1.el10ap
  • ansible-core ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1:2.16.19-1.el9ap
  • python3.12-pulpcore ansible automation platform 2.6, ansible automation platform 2.5 3.49.63-2.el9ap
  • python3.12-gitpython ansible automation platform 2.6, ansible automation platform 2.5 3.1.50-1.el9ap
  • automation-platform-ui ansible automation platform 2.6 2.6.11-1.el9ap
  • automation-gateway-proxy ansible automation platform 2.6 2.6.17-1.el9ap

red hat advisories RHSA-2026:42079RHSA-2026:42078RHSA-2026:37385

  • os-autoinst openSUSE Leap 16.0 5.1783082953.c3cb41d-bp160.1.1
  • openQA openSUSE Leap 16.0 5.1783076943.6691832d-bp160.1.1
  • openQA openSUSE Tumbleweed 5.1782995932.ffeb09be-1.1
  • python-pydata-sphinx-theme openSUSE Leap 16.0 0.16.1-bp160.2.1
  • python-pydata-sphinx-theme openSUSE Tumbleweed 0.17.1-1.1

opensuse advisories openSUSE-SU-2026:21266-1openSUSE-SU-2026:11178-1openSUSE-SU-2026:21173-1openSUSE-SU-2026:10750-1

Is CVE-2026-6321 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6321 updated cvss 7.5

fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies

  • Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-pccs Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8
    affected: no fix available
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform/automation-dashboard-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Build of Podman Desktop podman-desktop-macos-1-0, podman-desktop-windows-1-0 Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-bootc-rhel10 Red Hat Data Grid 8 org.infinispan-infinispan-console
    affected: no fix available
  • Red Hat Developer Hub 1 rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9
    affected: no fix available
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/logging-console-plugin-rhel9 1782841925, cluster-observability-operator/monitoring-console-plugin-rhel9 1782838476, cluster-observability-operator/logging-console-plugin-pf4-rhel9 1782839279, cluster-observability-operator/logging-console-plugin-pf5-rhel9 1782840539, cluster-observability-operator/distributed-tracing-console-plugin-rhel9 1782838753, cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9 1782839494, +4 more
    fixed: vendor fix RHSA-2026:34342
  • Red Hat HawtIO HawtIO 4.4.0
    fixed: vendor fix RHSA-2026:25089
  • Red Hat Network Observability (NETOBSERV) 1.12.3 network-observability/network-observability-console-plugin-rhel9 1780556069
    fixed: vendor fix RHSA-2026:24473
show 21 more
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8 1780082949
    fixed: vendor fix RHSA-2026:24766
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260715-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260715-1.el9ap
    fixed: vendor fix RHSA-2026:42078
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/lightspeed-rhel9 1779784904, ansible-automation-platform-tech-preview/mcp-server-rhel9 1779783248
    fixed: vendor fix RHSA-2026:24866
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.11-1.el9ap
    fixed: vendor fix RHSA-2026:42079
  • Red Hat Developer Hub 1.8 rhdh/rhdh-hub-rhel9 1779841586
    fixed: vendor fix RHSA-2026:21338
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1781187342
    fixed: vendor fix RHSA-2026:26234
  • Red Hat Discovery 2 discovery 1779395188
    fixed: vendor fix RHSA-2026:20338
  • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.1-1.el10_2
    fixed: vendor fix RHSA-2026:37385
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1780467029, rhoai/odh-mod-arch-model-registry-rhel9 1780467147
    fixed: vendor fix RHSA-2026:24977
  • Red Hat OpenShift AI 3.3 rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 1790331344, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1789651383, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1789651379, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 1790260954, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 1790072130, rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 1790072109, +12 more
    fixed: vendor fix RHSA-2026:73987
  • Red Hat Openshift Data Foundation 4.16 odf4/cephcsi-rhel9 1781183284, odf4/odf-cli-rhel9 1781183811, odf4/mcg-core-rhel9 1781183499, odf4/odf-console-rhel9 1781184611, odf4/mcg-rhel9-operator 1780663368, odf4/ocs-rhel9-operator 1780663548, +12 more
    fixed: vendor fix RHSA-2026:26416
  • Red Hat Openshift Data Foundation 4.17 odf4/cephcsi-rhel9 1791966003, odf4/odf-cli-rhel9 1791888742, odf4/mcg-core-rhel9 1791889616, odf4/odf-console-rhel9 1791887928, odf4/mcg-rhel9-operator 1791889753, odf4/ocs-rhel9-operator 1791960285, +13 more
    fixed: vendor fix RHSA-2026:83622
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1781555717, odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1781557189, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1781555645, odf4/mcg-core-rhel9 1786705558, +32 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat Openshift Data Foundation 4.19 odf4 1778576350, odf4 1778576707, odf4 1778576929, odf4 1778576957, odf4 1778577083, odf4 1778577150, +34 more
    fixed: vendor fix RHSA-2026:56366
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1786627460, odf4/odf-cli-rhel9 1786628142, odf4/mcg-core-rhel9 1786628235, odf4/odf-console-rhel9 1786628053, odf4/mcg-rhel9-operator 1786627106, odf4/ocs-rhel9-operator 1786629478, +16 more
    fixed: vendor fix RHSA-2026:57013
  • Red Hat Openshift Data Foundation 4.22 odf4/cephcsi-rhel9 1787057250, odf4/odf-cli-rhel9 1787058706, odf4/mcg-core-rhel9 1787058450, odf4/odf-drbd-rhel9 1787059538, odf4/odf-console-rhel9 1787059072, odf4/devicefinder-rhel9 1787057603, +22 more
    fixed: vendor fix RHSA-2026:56928
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/dashboard-rhel9 1780685176
    fixed: vendor fix RHSA-2026:25123
  • Red Hat Satellite 6.18 satellite/iop-advisor-frontend-rhel9 1781181673
    fixed: vendor fix RHSA-2026:26214
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1782839109, cluster-observability-operator/thanos-rhel9 1782840280, cluster-observability-operator/korrel8r-rhel9 1782839157, cluster-observability-operator/prometheus-rhel9 1782840780, cluster-observability-operator/alertmanager-rhel9 1782840761, cluster-observability-operator/perses-rhel9-operator 1782839191, +9 more
    not affected: vulnerable code not present
  • Red Hat Cryostat 4 cryostat-openshift-console-plugin-npm
    not affected: component not present
  • Red Hat Network Observability (NETOBSERV) 1.12.3 network-observability/network-observability-cli-rhel9 1780555785, network-observability/network-observability-rhel9-operator 1780555442, network-observability/network-observability-operator-bundle 1780921818, network-observability/network-observability-ebpf-agent-rhel9 1780555568, network-observability/network-observability-flowlogs-pipeline-rhel9 1780555437, network-observability/network-observability-console-plugin-pf4-rhel9 1780920979, +1 more Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1779772027, ansible-automation-platform-25/gateway-rhel8 1779788582, ansible-automation-platform-25/hub-web-rhel8 1779773575, ansible-automation-platform-25/receptor-rhel8 1779611418, ansible-automation-platform-25/controller-rhel8 1779787359, ansible-automation-platform-25/de-minimal-rhel8 1779772684, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.6-1.el8ap, receptorctl 1.6.6-1.el8ap, ansible-core 2.16.19-1.el8ap, ansible-test 2.16.19-1.el8ap, automation-hub 4.10.16-1.el8ap, python3.12-pyjwt 2.13.0-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.6-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-core 2.16.19-1.el9ap, ansible-test 2.16.19-1.el9ap, automation-hub 4.10.16-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, +20 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1779761061, ansible-automation-platform-26/gateway-rhel9 1779773804, ansible-automation-platform-26/hub-web-rhel9 1779765164, ansible-automation-platform-26/receptor-rhel9 1779770938, ansible-automation-platform-26/mcp-tools-rhel9 1779772877, ansible-automation-platform-26/controller-rhel9 1779762270, +22 more
    +2 more products
    Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.6-1.el9ap, molecule 26.6.0-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-sign 0.1.6-1.el9ap, ansible-lint 26.6.0-1.el9ap, ansible-core 2.16.19-1.el9ap, +39 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.6-1.el10ap, molecule 26.6.0-1.el10ap, receptorctl 1.6.6-1.el10ap, ansible-sign 0.1.6-1.el10ap, ansible-lint 26.6.0-1.el10ap, ansible-core 2.16.19-1.el10ap, +9 more
    not affected: vulnerable code not present

19 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6mo ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm fast-uri
>=3.0.0, <3.1.1
<2.4.1
3.1.1
2.4.1

Affected products

  • fast-uri fast-uri
  • Red Hat HawtIO HawtIO 4.4.0
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat Network Observability (NETOBSERV) 1.12.2
  • Red Hat Red Hat Ansible Automation Platform 2.5
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat Openshift Data Foundation 4.16
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat Openshift Data Foundation 4.22
  • Red Hat Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Confidential Compute Attestation
  • Red Hat Cryostat 4
  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Build of Podman Desktop
  • Red Hat Red Hat Build of Podman Desktop - Tech Preview
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Developer Hub
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat Satellite 6
  • Red Hat streams for Apache Kafka 2
  • Red Hat streams for Apache Kafka 3

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of fastify/fast-uri published their own advisory on GitHub. Reviewed sources take precedence over it.