Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

fast-uri could redirect requests to unintended hosts

CVE-2026-75899 · published 2 months ago
Summary

The fast-uri library used in Node.js applications may decode a web address twice, turning a specially crafted URL into a different destination such as the local server. This can let an attacker make the server contact an address it shouldn’t, bypassing checks that rely on the original URL. Upgrade to version 2.4.5, 3.1.6, or 4.1.3 or later to fix the problem.

What to do
  • Update matteo.collina fast-uri to version 2.4.5.
  • Update matteo.collina fast-uri to version 3.1.6.
  • Update matteo.collina fast-uri to version 4.1.3.
  • Update fast-uri to version 2.4.5.
  • Update fast-uri to version 3.1.6.
  • Update fast-uri to version 4.1.3.
  • Update fast-uri to version 3.1.2-aikido.3.
  • Update rootio @rootio/fast-uri to version 3.1.2-root.io.3.
  • Update debian node-ajv to version 8.20.0~ds+~cs7.1.4-1.
  • Update fast-uri to version 4.1.3-aikido.1.
  • Update rootio @rootio/fast-uri to version 4.1.3-root.io.1.
  • Update fast-uri to version 3.1.6-aikido.1.
  • Update rootio @rootio/fast-uri to version 3.1.6-root.io.1.
  • Update fast-uri fast-uri to version 2.4.5 or later.
Affected software
Ecosystem VendorProductAffected versions
npm matteo.collina fast-uri >= 2.4.1, < 2.4.5
>= 3.1.2, < 3.1.6
>= 4.0.0, < 4.1.3
Fix: upgrade to 2.4.5
Ubuntu:18.04:LTS canonical node-ajv All versions
Debian:14 debian node-ajv < 8.20.0~ds+~cs7.1.4-1
Fix: upgrade to 8.20.0~ds+~cs7.1.4-1
– fast-uri fast-uri < 2.4.5
Debian:13 debian node-ajv All versions
– openjsf fast-uri >= 2.4.1, < 2.4.5
>= 3.1.2, < 3.1.6
>= 4.0.0, < 4.1.3
cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*
npm – fast-uri >= 2.4.1, < 2.4.5
>= 3.1.2, < 3.1.6
>= 4.0.0, < 4.1.3
Fix: upgrade to 2.4.5
Root:npm – fast-uri < 3.1.2-aikido.3
< 4.1.3-aikido.1
< 3.1.6-aikido.1
Fix: upgrade to 3.1.2-aikido.3
Root:npm rootio @rootio/fast-uri < 3.1.2-root.io.3
< 4.1.3-root.io.1
< 3.1.6-root.io.1
Fix: upgrade to 3.1.2-root.io.3
Original advisory text
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-174Double Decoding of the Same Data
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published24 Aug 2026
Updated4 Nov 2026
First seen24 Aug 2026
Sources
CVE-2026-75899 · NVD
CVE-2026-75899 · MITRE
DEBIAN-CVE-2026-75899 · OSV
CVE-2026-75899 · OSV
GHSA-fph4-wmhf-6fwf · GHSA
UBUNTU-CVE-2026-75899 · OSV
ROOT-APP-NPM-CVE-2026-75899 · OSV
Track software like this
Free during beta