From a2bc950a4c84e8ed8aed408afb4afcfbf829b574 Mon Sep 17 00:00:00 2001
From: Joshua Lang <joshua.lang@humaninterest.com>
Date: Thu, 6 Aug 2026 15:14:29 -0700
Subject: [PATCH] Improve GHSA-q3j6-qgpj-74h6

---
 .../GHSA-q3j6-qgpj-74h6.json                  | 26 +++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/advisories/github-reviewed/2026/05/GHSA-q3j6-qgpj-74h6/GHSA-q3j6-qgpj-74h6.json b/advisories/github-reviewed/2026/05/GHSA-q3j6-qgpj-74h6/GHSA-q3j6-qgpj-74h6.json
index dee6cae90fdc..8fdb0146adb3 100644
--- a/advisories/github-reviewed/2026/05/GHSA-q3j6-qgpj-74h6/GHSA-q3j6-qgpj-74h6.json
+++ b/advisories/github-reviewed/2026/05/GHSA-q3j6-qgpj-74h6/GHSA-q3j6-qgpj-74h6.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q3j6-qgpj-74h6",
-  "modified": "2026-05-08T17:15:09Z",
+  "modified": "2026-05-08T17:15:11Z",
   "published": "2026-05-08T17:15:09Z",
   "aliases": [
     "CVE-2026-6321"
   ],
   "summary": "fast-uri vulnerable to path traversal via percent-encoded dot segments",
-  "details": "### Impact\n\n`fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path.\n\nFor example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI.\n\nApplications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.\n\n### Patches\n\nUpgrade to `fast-uri` >= 3.1.1.\n\n### Workarounds\n\nNone. Upgrade to the patched version.",
+  "details": "### Impact\n\n`fast-uri` v3.1.0 and earlier decodes percent-encoded path separators (`%2F`) and dot segments (`%2E`) before applying dot-segment removal in `normalize()` and `equal()`. This makes encoded path data behave like real `/` and `..`, so distinct URIs collapse onto the same normalized path.\n\nFor example, `http://example.com/public/%2e%2e/admin` normalizes to `http://example.com/admin`, and `equal()` considers them the same URI.\n\nApplications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.\n\n### Patches\n\nUpgrade to `fast-uri` >= 3.1.1, `fast-uri` >= 2.4.1\n\n### Workarounds\n\nNone. Upgrade to the patched version.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -36,6 +36,28 @@
       "database_specific": {
         "last_known_affected_version_range": "<= 3.1.0"
       }
+    },
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "fast-uri"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.4.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2.4.0"
+      }
     }
   ],
   "references": [