Echo has a Static Middleware Double-Unescape Path Traversal

Summary Commit a9ede66a PR 3006, issue 2599 silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally...

CVE-2026-118655 Echo: Static Middleware Double-Unescape Path Traversal

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...

CVE-2026-118655 Echo: Static Middleware Double-Unescape Path Traversal

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...

CVE-2026-118655 Echo: Static Middleware Double-Unescape Path Traversal

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...

CVE-2026-118655

The Echo Go web framework is vulnerable to a path traversal issue in versions prior to 4.15.3 and 5.2.0 . The middleware.Static component can perform a second decoding on an already decoded Request.URL.Path . This allows an attacker to use double-encoded separators to reconstruct restricted paths...

Fast-uri Vulnerable To URI Scheme Spoofing Via Percent-encoded Scheme Decoding

Impact "fast-uri" percent-decodes the scheme component with the legacy global "unescape" before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser...

EUVD-2026-104814

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding...

SUSE CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

DEBIAN-CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

UBUNTU-CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306

The fast-uri Node.js URI parser and serializer is vulnerable to URI scheme spoofing in versions before 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2. The root cause is that the library uses the legacy global unescape() function to percent-decode the scheme component before validation. This ...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

PT-2026-118254

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.8 fast-uri versions 3.0.0 through 3.1.8 fast-uri versions 4.0.0 through 4.2.2 Description The software percent-decodes the scheme component using the legacy global unescape function before validation. This allows...

Red Hat: CVE-2026-110306: fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

Linux Distros Unpatched Vulnerability : CVE-2026-110306

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2,...

Fastify fast-uri input validation vulnerability

Versions of Fastify prior to 2.4.8, as well as versions 3.0.0 to 3.1.8 and 4.0.0 to 4.2.2, contain security vulnerabilities. These vulnerabilities stem from the use of the outdated global unescape function for percent decoding before verifying scheme components. This may result in dangerous schem...

Astra Linux – Vulnerability in aspell

The libaspell.a module in GNU Aspell prior to version 0.60.8 has a stack-based buffer overflow issue in the common::unescape function within common/getdata.cpp, caused by an isolated \ character...