fast-uri is a dependency‑free URI parser that, in versions prior to 2.4.8, 3.1.9, and 4.2.3, mistakenly removes dot segments from the path of a relative reference during normalization. This behavior can turn a document‑relative path containing leading parent directories into a root‑relative path. If an application normalizes attacker‑supplied relative references before using them for cache, deduplication, or authorization keys, the reference can escape its intended directory and point at an unintended resource. The flaw is a path‑normalization error (CWE‑22) combined with improper reference handling (CWE‑41).

Vendors: fast‑uri developers (fast‑uri package). Affected releases include all versions prior to 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2. The issue is resolved in 2.4.8, 3.1.9, and 4.2.3 and later releases.

The CVSS score is 3.7, indicating a low‑severity vulnerability. The EPSS score is below 1%, implying a minimal expected exploitation rate. The vulnerability is not listed in CISA’s KEV catalog. The exploitation scenario requires an attacker to supply a crafted relative reference that is later normalized; if the application uses this value for keying or permission checks, the attacker may obtain unauthorized access or bypass authorization controls. The attack vector is input‑based and relies on the application’s use of normalize() or serialize() with untrusted data.