The bug in fast‑uri causes percent‑encoded slashes and dot segments to be decoded before the standard dot‑segment removal routine runs. This means attacker‑controlled URLs containing encoded pathname components can resolve to a different file system location than the one they appear to target. If an application uses fast‑uri to enforce a path‑based restriction or to compare URLs, it can be tricked into believing a request is confined to an allowed area while in fact it points elsewhere. The vulnerability is a typical example of CWE‑22, a path traversal weakness that can undermine confidentiality and integrity of protected resources.

Vendors affected are applications that depend on the fast‑uri library (fast‑uri:fast‑uri). All releases up to and including version 3.1.0 are vulnerable. The recommended fix is to update to version 3.1.1 or later. Any deployment that performs URI normalization or comparison against an attacker‑controlled string with an allowed‑prefix policy should review the library version and usage.

The CVSS score of 7.5 indicates a high severity, and the lack of an EPSS score means the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a specially crafted URL to an application that performs fast‑uri normalization or equality checks on untrusted input. Once exploited, the attacker can have their requested resource map to an unintended location, potentially giving them unauthorized access to protected files or data.