CVE-2026-110095

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

CVE-2026-110725 fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

CVE-2026-110095

The fast-uri Node.js URI parser and serializer is vulnerable to an improper path equivalence issue in versions before 2.4.8 , 3.0.0 through 3.1.8 , and 4.0.0 through 4.2.2 . The normalize() and serialize() functions incorrectly apply RFC 3986 dot-segment removal to relative-path references before...

CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

EUVD-2026-104812

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

PT-2026-118255

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

PT-2026-118248

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

CVE-2025-55752

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability Docker-based reproduction environment for CVE-2025-55752, a path traversal vulnerability in Apache Tomcat 10.1.44. Overview CVE-2025-55752 is a path traversal vulnerability in Apache Tomcat's RewriteValve caused by incorrect processing...

Astra Linux – Vulnerability in commons-io

In Apache Commons IO before version 2.7, when the FileNameUtils.normalize method was called with an improper input string, such as “//../foo” or “\..\foo”, the result would be the same value. This potentially allowed access to files in the parent directory, but not further up the path thus...

fast-uri vulnerable to authority injection via an unvalidated port in serialize

Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...

GHSA-QW65-CVWX-89V3 fast-uri vulnerable to authority injection via an unvalidated port in serialize

Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...

PT-2026-95434

Name of the Vulnerable Software and Affected Versions uri-js versions prior to 4.4.2 Description A denial of service issue exists in the removeDotSegments function. The function enters an infinite loop when a path segment starts with Unicode line or paragraph separators. This can be triggered by...

CVE-2026-49030: Undefined Security Weakness

pathe through 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join, resolve, and normalize to interpret backslash-separated dot notation sequences as directory traversal,...

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

Summary xmldom's malformed-input error-recovery path has two quadratic-time On² behaviors that a single crafted input triggers together, so a tiny, highly compressible document tens of KB stalls the Node.js event loop for multiple seconds. It is reachable from DOMParser.parseFromString under...

GHSA-93R5-FHX6-VMG9 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

Summary xmldom's malformed-input error-recovery path has two quadratic-time On² behaviors that a single crafted input triggers together, so a tiny, highly compressible document tens of KB stalls the Node.js event loop for multiple seconds. It is reachable from DOMParser.parseFromString under...

EUVD-2026-69234

xmldom: Quadratic-time parsing via the malformed-input recovery path — parseElementStartPart re-scan and normalize adjacent-text merge...

CVE-2026-86434: Inefficient Algorithmic Complexity

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...

GHSA-FPH4-WMHF-6FWF fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...

CVE-2026-84292: Improper Encoding or Escaping of Output

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

AZL-99357 CVE-2026-83614 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...