GHSA-xhq7-xmqj-769h: Low severity npm/fast-uri vulnerability
Impact
fast-uri's normalize() and serialize() apply RFC 3986 dot-segment removal (removedotsegments) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading .. segments and can turn a document-relative reference into a root-relative one.
For example, normalize('a/../b') returns /b and normalize('../x') returns x, so resolve(base, normalize(ref)) points at a different resource than resolve(base, ref), and equal() treats distinct references as the same.
Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.
Patches
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.
Workarounds
Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.9 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.9 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.2.3 - Compensating control
Do not normalize a relative reference before resolving it. Resolve the reference against the absolute base first, then normalize the absolute result.
Event History
Frequently Asked Questions
Which uses are exposed to this issue?
Applications are exposed if they normalize attacker- or user-supplied relative references before resolving them against an absolute base. Uses that treat normalized relative references as cache, deduplication, or authorization keys are also affected because distinct references can compare as equal.
What does an attacker need to supply to trigger incorrect resolution?
An attacker needs to control a relative reference containing dot segments, such as "a/../b" or "../x", that the application normalizes before resolution. The normalization can remove leading ".." segments or change a document-relative reference into a root-relative one, causing it to target a different resource.
What can be done if an upgrade cannot be applied immediately?
Do not normalize a relative reference before resolving it. Resolve the reference against its absolute base first, then normalize the resulting absolute URI.
Which fast-uri releases contain the fix?
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.