{"action":"Upgrade fast-uri to 2.4.1 or later.","affected":[{"fixed":"3.1.1","introduced":"3.0.0"},{"fixed":"2.4.1","introduced":"0"}],"component":"fast-uri","cve_ids":["CVE-2026-6321"],"ecosystem":"npm","epss":0.00634,"exploited":false,"fixed_versions":["3.1.1","2.4.1"],"ghsa_id":"GHSA-q3j6-qgpj-74h6","id":"tcs_01M5KG4YR71WJBGAD9VZ7MJQET","modified_at":"2026-09-10T03:51:06.746866846Z","published_at":"2026-05-08T17:15:09Z","references":["https://osv.dev/vulnerability/GHSA-q3j6-qgpj-74h6","https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","https://nvd.nist.gov/vuln/detail/CVE-2026-6321","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json","https://github.com/fastify/fast-uri/releases/tag/v3.1.1","https://github.com/fastify/fast-uri/releases/tag/v2.4.1","https://github.com/fastify/fast-uri","https://cna.openjsf.org/security-advisories.html","https://bugzilla.redhat.com/show_bug.cgi?id=2466582","https://access.redhat.com/security/cve/CVE-2026-6321","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:37385","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26416","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:24866","https://access.redhat.com/errata/RHSA-2026:24766","https://access.redhat.com/errata/RHSA-2026:24473","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:19238"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-q3j6-qgpj-74h6","url":"https://osv.dev/vulnerability/GHSA-q3j6-qgpj-74h6"}],"summary":"fast-uri vulnerable to path traversal via percent-encoded dot segments"}