Detections
Analytics

SCA: security update for fast-uri (GHSA-xhq7-xmqj-769h)

low Tenable Cloud Security Plugin ID 477219

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8,
 from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply
 RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is
 defined only for the merged target path during resolution, so a leading parent-directory segment can be
 dropped and a document-relative reference can become root-relative. An application that normalizes an
 attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache,
 deduplication, or authorization key, can have the reference escape its intended directory and point at a
 different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to
 one of these versions or later. As a workaround, resolve a relative reference against its absolute base
 first and normalize the absolute result instead of normalizing the reference beforehand. (CVE-2026-110095)

Solution

Update the fast-uri library and its related packages to version 2.4.8 or later.

See Also

https://github.com/advisories/GHSA-xhq7-xmqj-769h

Plugin Details

Severity: Low

ID: 477219

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/24/2026

Updated: 10/24/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-110095

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 10/20/2026

Reference Information

CVE: CVE-2026-110095

cwe: CWE-41