Skip to content
Fencer Vulns
high 7.5

CVE-2026-6321 json

fast-uri vulnerable to path traversal via percent-encoded dot segments

published 2026-05-04 6 mo ago modified 2026-09-10 1 mo ago also GHSA-q3j6-qgpj-74h6 , EUVD-2026-27129

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

Patch / fix

  • npm fast-uri 2.4.1, 3.1.1
  • fast-uri fast-uri 3.1.1
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20260715-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20260715-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.11-1.el9ap
  • Red Hat Red Hat Enterprise Linux 10 0:1.1.1-1.el10_2
  • Red Hat Cluster Observability Operator 1.5.0 1782838476, 1782838753, 1782839193, 1782839279, 1782839494, 1782839981, 1782839996, 1782840519, 1782840539, 1782841925
  • Red Hat Network Observability (NETOBSERV) 1.12.2 1780556069
  • Red Hat Red Hat Ansible Automation Platform 2.5 1780082949
  • Red Hat Red Hat Ansible Automation Platform 2.6 1779783248, 1779784904
  • Red Hat Red Hat Developer Hub 1.8 1779841586
  • Red Hat Red Hat Developer Hub 1.9 1781187342
  • Red Hat Red Hat Discovery 2 1779395188
  • Red Hat Red Hat OpenShift AI 2.25 1780467029, 1780467147
  • Red Hat Red Hat Openshift Data Foundation 4.16 1780663368, 1780663548, 1780663596, 1780663638, 1780663861, 1780663886, 1780663920, 1780664089, 1780664140, 1781183284, 1781183499, 1781183713, 1781183811, 1781184121, 1781184239, 1781184468, 1781184484, 1781184611
  • Red Hat Red Hat Openshift Data Foundation 4.18 1781554936, 1781555645, 1781555679, 1781555708, 1781555717, 1781556009, 1781556534, 1781557189, 1781557202, 1781558423, 1786705347, 1786705558, 1786705646, 1786705741, 1786705777, 1786705802, 1786705938, 1786706101, 1786706138, 1786706577
  • Red Hat Red Hat Openshift Data Foundation 4.19 1778576350, 1778576707, 1778576929, 1778576957, 1778577083, 1778577150, 1778577175, 1778769574, 1778770148, 1779093256, 1786701555, 1786701839, 1786702052, 1786702264, 1786702276, 1786702315, 1786702440, 1786702448, 1786702559, 1786702713
  • Red Hat Red Hat Openshift Data Foundation 4.20 1786626399, 1786627106, 1786627382, 1786627430, 1786627460, 1786627469, 1786627559, 1786628053, 1786628142, 1786628235, 1786628340, 1786628623, 1786629076, 1786629478, 1786629761, 1786631508, 1786632256, 1786644072, 1786687918, 1786688215
  • Red Hat Red Hat Openshift Data Foundation 4.22 1787057250, 1787057603, 1787057849, 1787057964, 1787057989, 1787058278, 1787058403, 1787058450, 1787058588, 1787058658, 1787058706, 1787058807, 1787058970, 1787059072, 1787059085, 1787059538, 1787059616, 1787059853, 1787060257, 1787061098
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 1780685176
  • Red Hat Red Hat Satellite 6.18 1781181673
  • node-ajv Debian 14 8.20.0~ds+~cs6.1.3-1

debian advisories DEBIAN-CVE-2026-6321

  • receptor ansible automation platform 2.6 1.6.6-1.el10ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.6-1.el9ap
  • ansible-core ansible automation platform developer 2.6, ansible automation platform 2.6 2:2.16.19-1.el10ap
  • ansible-core ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1:2.16.19-1.el9ap
  • python3.12-pulpcore ansible automation platform 2.6 3.49.63-2.el9ap
  • python3.12-gitpython ansible automation platform 2.6 3.1.50-1.el9ap
  • automation-platform-ui ansible automation platform 2.6 2.6.11-1.el9ap
  • automation-gateway-proxy ansible automation platform 2.6 2.6.17-1.el9ap

red hat advisories RHSA-2026:42079RHSA-2026:42078RHSA-2026:37385

  • os-autoinst openSUSE Leap 16.0 5.1783082953.c3cb41d-bp160.1.1
  • openQA openSUSE Leap 16.0 5.1783076943.6691832d-bp160.1.1
  • openQA openSUSE Tumbleweed 5.1782995932.ffeb09be-1.1
  • python-pydata-sphinx-theme openSUSE Leap 16.0 0.16.1-bp160.2.1
  • python-pydata-sphinx-theme openSUSE Tumbleweed 0.17.1-1.1

opensuse advisories openSUSE-SU-2026:21266-1openSUSE-SU-2026:11178-1openSUSE-SU-2026:21173-1openSUSE-SU-2026:10750-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6321 updated cvss 7.5

fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies

  • Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-pccs Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8
    affected: no fix available
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform/automation-dashboard-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Build of Podman Desktop podman-desktop-macos-1-0, podman-desktop-windows-1-0 Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-bootc-rhel10 Red Hat Data Grid 8 org.infinispan-infinispan-console
    affected: no fix available
  • Red Hat Developer Hub 1 rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9
    affected: no fix available
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/logging-console-plugin-rhel9 1782841925, cluster-observability-operator/monitoring-console-plugin-rhel9 1782838476, cluster-observability-operator/logging-console-plugin-pf4-rhel9 1782839279, cluster-observability-operator/logging-console-plugin-pf5-rhel9 1782840539, cluster-observability-operator/distributed-tracing-console-plugin-rhel9 1782838753, cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9 1782839494, +4 more
    fixed: vendor fix RHSA-2026:34342
  • Red Hat HawtIO HawtIO 4.4.0
    fixed: vendor fix RHSA-2026:25089
  • Red Hat Network Observability (NETOBSERV) 1.12.3 network-observability/network-observability-console-plugin-rhel9 1780556069
    fixed: vendor fix RHSA-2026:24473
show 21 more
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8 1780082949
    fixed: vendor fix RHSA-2026:24766
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260715-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260715-1.el9ap
    fixed: vendor fix RHSA-2026:42078
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/lightspeed-rhel9 1779784904, ansible-automation-platform-tech-preview/mcp-server-rhel9 1779783248
    fixed: vendor fix RHSA-2026:24866
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.11-1.el9ap
    fixed: vendor fix RHSA-2026:42079
  • Red Hat Developer Hub 1.8 rhdh/rhdh-hub-rhel9 1779841586
    fixed: vendor fix RHSA-2026:21338
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1781187342
    fixed: vendor fix RHSA-2026:26234
  • Red Hat Discovery 2 discovery 1779395188
    fixed: vendor fix RHSA-2026:20338
  • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.1-1.el10_2
    fixed: vendor fix RHSA-2026:37385
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1780467029, rhoai/odh-mod-arch-model-registry-rhel9 1780467147
    fixed: vendor fix RHSA-2026:24977
  • Red Hat OpenShift AI 3.3 rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 1790331344, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1789651383, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1789651379, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 1790260954, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 1790072130, rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 1790072109, +12 more
    fixed: vendor fix RHSA-2026:73987
  • Red Hat Openshift Data Foundation 4.16 odf4/cephcsi-rhel9 1781183284, odf4/odf-cli-rhel9 1781183811, odf4/mcg-core-rhel9 1781183499, odf4/odf-console-rhel9 1781184611, odf4/mcg-rhel9-operator 1780663368, odf4/ocs-rhel9-operator 1780663548, +12 more
    fixed: vendor fix RHSA-2026:26416
  • Red Hat Openshift Data Foundation 4.17 odf4/cephcsi-rhel9 1791966003, odf4/odf-cli-rhel9 1791888742, odf4/mcg-core-rhel9 1791889616, odf4/odf-console-rhel9 1791887928, odf4/mcg-rhel9-operator 1791889753, odf4/ocs-rhel9-operator 1791960285, +13 more
    fixed: vendor fix RHSA-2026:83622
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1781555717, odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1781557189, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1781555645, odf4/mcg-core-rhel9 1786705558, +32 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat Openshift Data Foundation 4.19 odf4 1778576350, odf4 1778576707, odf4 1778576929, odf4 1778576957, odf4 1778577083, odf4 1778577150, +34 more
    fixed: vendor fix RHSA-2026:56366
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1786627460, odf4/odf-cli-rhel9 1786628142, odf4/mcg-core-rhel9 1786628235, odf4/odf-console-rhel9 1786628053, odf4/mcg-rhel9-operator 1786627106, odf4/ocs-rhel9-operator 1786629478, +16 more
    fixed: vendor fix RHSA-2026:57013
  • Red Hat Openshift Data Foundation 4.22 odf4/cephcsi-rhel9 1787057250, odf4/odf-cli-rhel9 1787058706, odf4/mcg-core-rhel9 1787058450, odf4/odf-drbd-rhel9 1787059538, odf4/odf-console-rhel9 1787059072, odf4/devicefinder-rhel9 1787057603, +22 more
    fixed: vendor fix RHSA-2026:56928
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/dashboard-rhel9 1780685176
    fixed: vendor fix RHSA-2026:25123
  • Red Hat Satellite 6.18 satellite/iop-advisor-frontend-rhel9 1781181673
    fixed: vendor fix RHSA-2026:26214
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1782839109, cluster-observability-operator/thanos-rhel9 1782840280, cluster-observability-operator/korrel8r-rhel9 1782839157, cluster-observability-operator/prometheus-rhel9 1782840780, cluster-observability-operator/alertmanager-rhel9 1782840761, cluster-observability-operator/perses-rhel9-operator 1782839191, +9 more
    not affected: vulnerable code not present
  • Red Hat Cryostat 4 cryostat-openshift-console-plugin-npm
    not affected: component not present
  • Red Hat Network Observability (NETOBSERV) 1.12.3 network-observability/network-observability-cli-rhel9 1780555785, network-observability/network-observability-rhel9-operator 1780555442, network-observability/network-observability-operator-bundle 1780921818, network-observability/network-observability-ebpf-agent-rhel9 1780555568, network-observability/network-observability-flowlogs-pipeline-rhel9 1780555437, network-observability/network-observability-console-plugin-pf4-rhel9 1780920979, +1 more Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1779772027, ansible-automation-platform-25/gateway-rhel8 1779788582, ansible-automation-platform-25/hub-web-rhel8 1779773575, ansible-automation-platform-25/receptor-rhel8 1779611418, ansible-automation-platform-25/controller-rhel8 1779787359, ansible-automation-platform-25/de-minimal-rhel8 1779772684, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.6-1.el8ap, receptorctl 1.6.6-1.el8ap, ansible-core 2.16.19-1.el8ap, ansible-test 2.16.19-1.el8ap, automation-hub 4.10.16-1.el8ap, python3.12-pyjwt 2.13.0-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.6-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-core 2.16.19-1.el9ap, ansible-test 2.16.19-1.el9ap, automation-hub 4.10.16-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, +20 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1779761061, ansible-automation-platform-26/gateway-rhel9 1779773804, ansible-automation-platform-26/hub-web-rhel9 1779765164, ansible-automation-platform-26/receptor-rhel9 1779770938, ansible-automation-platform-26/mcp-tools-rhel9 1779772877, ansible-automation-platform-26/controller-rhel9 1779762270, +22 more
    +2 more products
    Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.6-1.el9ap, molecule 26.6.0-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-sign 0.1.6-1.el9ap, ansible-lint 26.6.0-1.el9ap, ansible-core 2.16.19-1.el9ap, +39 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.6-1.el10ap, molecule 26.6.0-1.el10ap, receptorctl 1.6.6-1.el10ap, ansible-sign 0.1.6-1.el10ap, ansible-lint 26.6.0-1.el10ap, ansible-core 2.16.19-1.el10ap, +9 more
    not affected: vulnerable code not present

19 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm fast-uri
>=3.0.0, <3.1.1
<2.4.1
3.1.1
2.4.1

Affected products

  • fast-uri fast-uri
  • Red Hat HawtIO HawtIO 4.4.0
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat Network Observability (NETOBSERV) 1.12.2
  • Red Hat Red Hat Ansible Automation Platform 2.5
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat Openshift Data Foundation 4.16
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat Openshift Data Foundation 4.22
  • Red Hat Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Confidential Compute Attestation
  • Red Hat Cryostat 4
  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Build of Podman Desktop
  • Red Hat Red Hat Build of Podman Desktop - Tech Preview
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Developer Hub
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat Satellite 6
  • Red Hat streams for Apache Kafka 2
  • Red Hat streams for Apache Kafka 3

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.