CVE-2026-75899
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The fast-uri URI parser for Node.js decodes percent escapes in the hostname twice, potentially changing the destination to loopback or another internal address. Affected versions are 2.4.1 up to 2.4.4, 3.1.2 up to 3.1.5, and 4.0.0 up to 4.1.2.
Risk Assessment
Applications normalizing or resolving untrusted URIs before outbound requests can receive a different destination than originally encoded, enabling SSRF and host-policy bypass.
Recommendation
Upgrade fast-uri to 2.4.5, 3.1.6, or 4.1.3, which normalize percent escapes once and preserve encoded percent signs.
Other vulnerabilities in fast-uri
See all- CVE-2026-76172High
The fast-uri URI parser for Node.js mishandles schemes with percent-encoded slashes, allowing an attacker to manipulate the host and bypass allowlists. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-75975High
The fast-uri URI parser for Node.js incorrectly validates bracketed IPv6 literals, allowing a malicious host to be transformed into a different IPv6 destination, such as loopback or private address. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-75931High
The fast-uri URI parser for Node.js does not canonicalize the host in scheme-relative references, leading to inconsistencies between parse, resolve, normalize, and equal functions. Affected versions are 2.4.2 up to 2.4.4, 3.1.3 up to 3.1.5, and 4.0.1 up to 4.1.2.
- CVE-2026-18446High
The fast-uri library before versions 4.1.2, 3.1.5, and 2.4.4 incorrectly parses URIs when a backslash is used instead of a double forward slash. Node.js treats backslash as interchangeable with forward slash, leading to differences in host parsing. Applications using fast-uri for host-based policy enforcement can be steered to an unintended host.
- CVE-2026-16221High
Vulnerability in fast-uri library (versions 2.3.1-4.1.0, 3.x up to 3.1.3, 2.x up to 2.4.2). Backslash is not treated as an authority delimiter, while Node's parser normalizes it to slash. Parsing discrepancy can bypass host-based policies (allowlists, SSRF filtering).
- CVE-2026-13676High
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. This causes discrepancies between fast-uri and Node's native URL parser, potentially bypassing host-based policies.
- CVE-2026-6322High
In fast-uri versions up to 3.1.1, the normalize() function decoded percent-encoded authority delimiters inside the host component and re-emitted them as raw delimiters during serialization. This allows an attacker to change the URI authority to a different domain than the input appeared to specify.
- CVE-2026-6321High
In the fast-uri library, the normalize() and equal() functions decoded percent-encoded path separators and dot segments before applying dot-segment removal. Encoded path data was treated as real slashes and parent-directory references, causing distinct URIs to collapse onto the same normalized path. Versions up to 3.1.0 are affected.
Original NVD description (English source)
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.