https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 01:54:31 +0000 https://db.gcve.eu/vuln/ghsa-q3j6-qgpj-74h6 <p><strong>Affected:</strong> npm: fast-uri</p> <p>### Impact</p> <p>`fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path.</p> <p>For example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI.</p> <p>Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.</p> <p>### Patches</p> <p>Upgrade to `fast-uri` &gt;= 3.1.1, or if you are in the v2.x release line, v2.4.1</p> <p>### Workarounds</p> <p>None. Upgrade to the patched version.</p> <p><strong>Affected:</strong> npm: fast-uri</p> <p>### Impact</p> <p>`fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path.</p> <p>For example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI.</p> <p>Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.</p> <p>### Patches</p> <p>Upgrade to `fast-uri` &gt;= 3.1.1, or if you are in the v2.x release line, v2.4.1</p> <p>### Workarounds</p> <p>None. Upgrade to the patched version.</p> https://db.gcve.eu/vuln/ghsa-q3j6-qgpj-74h6