A Hidden Trick in Web Addresses Is Letting Attackers Sneak Past Security Doors

Your application thinks it's guarding the front door — but attackers have discovered the lock reads the address wrong.

Who's at Risk, and How Bad Is It?

The vulnerability lives inside fast-uri, a JavaScript library downloaded millions of times per week via the npm package registry. It's the quiet plumbing behind countless Node.js web applications, APIs, and cloud services responsible for reading, cleaning up, and comparing web addresses. If your app uses fast-uri version 3.1.0 or earlier to decide whether a user is allowed to access a particular URL path — and a huge number do — an attacker can potentially trick it into granting access to paths that should be completely off-limits. We're talking internal admin panels, private files, restricted API endpoints, and backend configuration routes. The vulnerability carries a CVSS score of 7.5 (HIGH) and affects every major operating system and cloud platform.

The Con Artist in the Web Address

To understand what's happening here, picture a building with a security guard standing at the elevator, checking a list of approved floor numbers. You want to get to the executive floor — Floor 10 — but you're only approved for Floor 3. So instead of asking for "Floor 10" directly, you hand the guard a cleverly folded piece of paper. Written on it, in a coded shorthand the guard doesn't fully decode before checking his list, is something that looks like "Floor 3" at first glance — but unfolds into directions for Floor 10. The guard waves you through. That's essentially what's happening here, except the coded shorthand is how web addresses encode special characters.

Web addresses have a long-standing convention: certain characters — like forward slashes (/) that separate folders, or double-dots (..) that mean "go up one directory level" — can be written in a disguised form called percent-encoding. A slash becomes %2F. A dot becomes %2E. The rule, universally agreed upon, is that you should decode these disguised characters after you've done your security checks — not before. fast-uri was doing it in the wrong order: decoding the disguised characters first, then checking paths. That meant an attacker could craft a URL like /api/public/%2E%2E%2Fsecrets, which looks like it's safely under the allowed /api/public/ prefix, but after fast-uri's confused normalization process, resolves to /api/secrets — a completely different, potentially protected location.

The practical blast radius is significant. Any web framework, reverse proxy, API gateway, or authentication middleware that leans on fast-uri's normalize() or equal() functions to enforce path-based access rules is potentially vulnerable. An attacker doesn't need special tools or insider knowledge — just a crafted URL and an HTTP client. In many real-world deployments, that's enough to reach routes that expose user data, administrative functions, or internal service APIs that were never meant to be public-facing.

The Technical Detail Security Teams Need to Know

The root cause is a premature percent-decode before dot-segment removal in the URI normalization pipeline — a violation of the processing order specified in RFC 3986 Section 5.2. Specifically, fast-uri's normalize() and equal() functions decoded %2F (encoded slash) and %2E%2E (encoded dot-dot) into their literal characters before the dot-segment removal algorithm ran. This allowed encoded path traversal sequences to be treated as structural path components, collapsing semantically distinct URIs onto identical normalized paths. The vulnerability class is a classic path traversal via percent-encoding normalization confusion, and any authorization logic performing prefix matching or equality checks on fast-uri-normalized URLs inherits the flaw directly.

Who Found It, and Is It Being Exploited?

As of publication, no active exploitation in the wild has been confirmed, and there are no known victim organizations or active threat campaigns tied to CVE-2026-6321. However, security teams should treat that as a narrow window of opportunity, not a reason to relax. Vulnerabilities of this class — URL normalization bypasses in popular open-source libraries — have a consistent track record of being weaponized quickly once the patch is public and the diff is readable. The nature of the fix makes it trivially easy for researchers (and attackers) to reverse-engineer exactly what input pattern triggers the flaw. The vulnerability was reported through responsible disclosure, and the fast-uri maintainers responded by releasing the patched version 3.1.1.

Path-confusion attacks against URL normalization aren't new — variants have appeared in Apache, nginx, Spring, and dozens of other major platforms over the years. What makes this instance particularly sharp is how deeply embedded fast-uri is in the Node.js ecosystem, often sitting several dependency layers deep where developers may not even know it's there.

What You Should Do Right Now

1. Update fast-uri to version 3.1.1 immediately. Run npm install fast-uri@3.1.1 or update your package.json to pin "fast-uri": "^3.1.1". Then run npm audit to confirm the vulnerable version is no longer present anywhere in your dependency tree — including transitive (indirect) dependencies, where this library most commonly hides.
2. Audit every place your code normalizes or compares URLs for access control. Search your codebase for calls to normalize() and equal() from any URI library — not just fast-uri. If you're making security decisions (allow/deny, prefix matching, redirect validation) based on the output of URL normalization, ensure the library you're using decodes percent-encoded characters after structural normalization, per RFC 3986. If you're unsure, add a temporary layer of defense by decoding and re-checking paths in your own middleware before making authorization decisions.
3. Review your access logs for suspicious encoded path patterns. Look for requests containing sequences like %2F, %2E%2E, %252F (double-encoded slash), or similar percent-encoded structural characters in path segments targeting sensitive routes. While no active exploitation is confirmed, proactive threat hunting now — before attackers have had time to act — is the right posture. Flag any anomalies for your security team and consider temporarily adding a web application firewall (WAF) rule to block or alert on requests containing encoded slash and dot-dot sequences in path components.

CVE-2026-6321 | CVSS 7.5 (HIGH) | Affected: fast-uri ≤ 3.1.0 | Fixed: fast-uri 3.1.1 | Category: Authorization Bypass / Path Traversal