fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8,
    from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply
    RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is
    defined only for the merged target path during resolution, so a leading parent-directory segment can be
    dropped and a document-relative reference can become root-relative. An application that normalizes an
    attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache,
    deduplication, or authorization key, can have the reference escape its intended directory and point at a
    different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to
    one of these versions or later. As a workaround, resolve a relative reference against its absolute base
    first and normalize the absolute result instead of normalizing the reference beforehand. (CVE-2026-110095)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8,     from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply     RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is     defined only for the merged target path during resolution, so a leading parent-directory segment can be     dropped and a document-relative reference can become root-relative. An application that normalizes an     attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache,     deduplication, or authorization key, can have the reference escape its intended directory and point at a     different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to     one of these versions or later. As a workaround, resolve a relative reference against its absolute base     first and normalize the absolute result instead of normalizing the reference beforehand. (CVE-2026-110095)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477219	SCA: security update for fast-uri (GHSA-xhq7-xmqj-769h)	Tenable Cloud Security	SCA Checks	Local	low
477219	SCA: security update for fast-uri (GHSA-xhq7-xmqj-769h)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
367763	Linux Distros Unpatched Vulnerability : CVE-2026-110095	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-110095

low

Tenable Plugins

low

low

low