EXECUTIVE SUMMARY:
Multiple vulnerabilities have been identified in fast-uri, a library used for parsing and normalizing URIs, which can lead to various attacks such as host confusion via percent-encoded scheme normalization and server-side request forgery via repeated hostname percent-decoding or malformed IPv6 normalization.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple vulnerabilities have been identified in fast-uri, a library used for parsing and normalizing URIs, which can lead to various attacks such as host confusion via percent-encoded scheme normalization and server-side request forgery via repeated hostname percent-decoding or malformed IPv6 normalization.[emaillocker id="1283"]
CVE-2026-76172 (CVSS 7.5 — High): It is a vulnerability in fast-uri that allows percent-encoded characters in the URI scheme to introduce attacker-controlled authority or raw CRLF characters after normalization, potentially bypassing RFC 3986 scheme validation and enabling host validation bypass, SSRF, or HTTP header injection.
CVE-2026-75899 (CVSS 7.5 — High): It is a vulnerability in fast-uri where hostname percent escapes are decoded twice during normalize() or resolve(), allowing nested encoded hostnames to become attacker-controlled destinations and potentially bypass SSRF checks, redirect validation, or host allowlists to reach internal or cloud metadata endpoints.
CVE-2026-75975 (CVSS 7.5 — High): A vulnerability in fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, allowing an attacker to inject a malicious IPv6 address into a URI and steer the application to an internal destination.
CVE-2026-75931 (CVSS 7.5 — High): It is a vulnerability in fast-uri where scheme-relative URI references can bypass IDN host canonicalization, causing the host returned by resolve() to differ from the host obtained after reparsing and potentially enabling host validation or routing policy bypasses.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-jqff-g426-hqxp
https://github.com/advisories/GHSA-fph4-wmhf-6fwf
https://github.com/advisories/GHSA-f65p-4m7j-42xc
https://github.com/advisories/GHSA-5jgf-p345-68v8