How Path Traversal and Security Policy Bypass Happens in Node.js Dependencies and How to Fix It

Introduction

In the @apralabs/apra-fleet repository, a high-severity vulnerability was discovered lurking in the dependency tree. The culprit? The fast-uri package at version 3.1.0, which contained a critical flaw in how it handles Unicode characters during hostname canonicalization. This vulnerability, tracked as CVE-2026-6321, could allow attackers to craft specially-formed URIs that bypass security policies designed to restrict access based on hostnames or paths.

The package-lock.json file pinned fast-uri at version 3.1.0:

"node_modules/fast-uri": {
  "version": "3.1.0",
  "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
  "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA=="
}

This matters for any developer working with URI parsing in Node.js applications—especially those building APIs, proxies, or any system that makes security decisions based on URL components.

The Vulnerability Explained

What is Unicode Hostname Canonicalization?

When your application receives a URL like https://example.com/api/data, URI parsing libraries break it down into components: scheme, hostname, path, query, etc. However, Unicode introduces complexity. Characters that look similar can have different byte representations, and some Unicode sequences can be normalized into ASCII equivalents.

The fast-uri library, used extensively in the Node.js ecosystem (particularly by Fastify and Ajv for JSON Schema validation), failed to properly canonicalize Unicode hostnames before returning parsed URI components. This created a gap between what security code thought it was checking and what the actual resolved URI would be.

How Could This Be Exploited?

Consider an application that uses fast-uri to parse incoming URLs and enforces a security policy:

const fastUri = require('fast-uri');

function isAllowedHost(url) {
  const parsed = fastUri.parse(url);
  const allowedHosts = ['api.trusted.com', 'cdn.trusted.com'];
  return allowedHosts.includes(parsed.host);
}

An attacker could craft a URL using Unicode characters that:
1. Pass the hostname check (appearing different from blocked hosts)
2. Resolve to a malicious destination after normalization
3. Include path traversal sequences that escape intended directories

For example, using Unicode lookalike characters or special normalization forms, an attacker might bypass the hostname allowlist entirely, accessing internal resources or redirecting requests to attacker-controlled servers.

Real-World Impact for @apralabs/apra-fleet

The @apralabs/apra-fleet project handles fleet management operations. While the vulnerability was flagged as "present in dependency tree, not confirmed reachable," the risk profile is significant:

• API Gateway Bypass: If the application validates incoming webhook URLs or API endpoints, attackers could redirect traffic
• SSRF Potential: Server-side request forgery becomes possible if the application makes requests based on parsed URIs
• Data Exfiltration: Path traversal combined with policy bypass could expose sensitive fleet configuration data

The Fix

The fix involved two coordinated changes to ensure the patched version of fast-uri is used throughout the entire dependency tree.

Change 1: Package Version Bump

The project version was incremented from 0.4.0 to 0.4.1 to reflect the security update:

{
  "name": "@apralabs/apra-fleet",
  "version": "0.4.1"
}

Change 2: NPM Override for fast-uri

The critical fix was adding an npm override in package.json:

Before:

"overrides": {
  "undici": "^7.29.0"
}

After:

"overrides": {
  "undici": "^7.29.0",
  "fast-uri": "4.1.2"
}

Change 3: Lock File Update

The package-lock.json was updated to reflect the new version:

Before:

"node_modules/fast-uri": {
  "version": "3.1.0",
  "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
  "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/..."
}

After:

"node_modules/fast-uri": {
  "version": "4.1.2",
  "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.2.tgz",
  "integrity": "sha512-TyGmBcbDTZXcb2cj5MV89DrF42DKvb3y5DDUNh95iO+IMeAzMkVSxK1PZRrRIpc9yg8U2GhGdbofNa0LS/a4Bw==",
  "license": "BSD-3-Clause"
}

Why NPM Overrides Matter

The overrides field is crucial here. Even if your direct dependencies don't use fast-uri, transitive dependencies might. In the Node.js ecosystem, fast-uri is commonly pulled in by:

• Ajv (JSON Schema validator)
• Fastify (web framework)
• Various OpenAPI tools

Without the override, running npm install might still resolve to the vulnerable 3.1.0 version through nested dependencies. The override forces npm to use 4.1.2 everywhere in the dependency tree.

Key Takeaways

• Transitive dependencies are attack vectors: The fast-uri vulnerability wasn't a direct dependency of @apralabs/apra-fleet, but it still posed a risk through the dependency tree
• NPM overrides are essential for supply chain security: When you can't wait for upstream packages to update their dependencies, overrides let you enforce patched versions
• Unicode handling in URI parsing is a common vulnerability class: Always assume URI components may contain unexpected Unicode sequences that require canonicalization
• Version 3.1.0 of fast-uri should be treated as vulnerable: Any project using this version should upgrade to 4.0.1+, 3.1.3+, or 2.4.2+ depending on their compatibility requirements
• The fix preserved behavior for valid inputs: The upgrade only tightened handling of malicious Unicode sequences while maintaining compatibility with legitimate URIs

How Orbis AppSec Detected This

• Source: External URI input processed through the dependency tree containing fast-uri
• Sink: URI parsing operations in fast-uri@3.1.0 with improper Unicode hostname canonicalization
• Missing control: Proper Unicode normalization and canonicalization before security-relevant hostname comparisons
• CWE: CWE-22 (Path Traversal), CWE-20 (Improper Input Validation)
• Fix: Upgraded fast-uri from 3.1.0 to 4.1.2 via npm overrides in package.json, ensuring all transitive dependencies use the patched version

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-6321 in fast-uri demonstrates how subtle flaws in URI parsing—particularly around Unicode handling—can create significant security risks. The vulnerability affected not just direct users of the library but anyone with it in their dependency tree, including users of popular frameworks like Fastify.

The fix was straightforward: upgrade to a patched version and use npm overrides to ensure consistency across the dependency tree. However, the broader lesson is about supply chain security vigilance. Regular dependency audits, automated scanning, and understanding how to use tools like npm overrides are essential skills for modern Node.js development.

Keep your dependencies updated, implement defense in depth for any URI-based security decisions, and never assume that "it's just a parsing library" means it can't have security implications.