CVE-2026-75975
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The fast-uri URI parser for Node.js incorrectly validates bracketed IPv6 literals, allowing a malicious host to be transformed into a different IPv6 destination, such as loopback or private address. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
Risk Assessment
Applications normalizing untrusted URLs before outbound requests can be redirected to local or private services, enabling SSRF and address-policy bypass.
Recommendation
Upgrade fast-uri to 2.4.5, 3.1.6, or 4.1.3, which validate full IPv6 grammar and mark malformed literals as authority errors.
Other vulnerabilities in fast-uri
See all- CVE-2026-76172High
The fast-uri URI parser for Node.js mishandles schemes with percent-encoded slashes, allowing an attacker to manipulate the host and bypass allowlists. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-75931High
The fast-uri URI parser for Node.js does not canonicalize the host in scheme-relative references, leading to inconsistencies between parse, resolve, normalize, and equal functions. Affected versions are 2.4.2 up to 2.4.4, 3.1.3 up to 3.1.5, and 4.0.1 up to 4.1.2.
- CVE-2026-75899High
The fast-uri URI parser for Node.js decodes percent escapes in the hostname twice, potentially changing the destination to loopback or another internal address. Affected versions are 2.4.1 up to 2.4.4, 3.1.2 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-18446High
The fast-uri library before versions 4.1.2, 3.1.5, and 2.4.4 incorrectly parses URIs when a backslash is used instead of a double forward slash. Node.js treats backslash as interchangeable with forward slash, leading to differences in host parsing. Applications using fast-uri for host-based policy enforcement can be steered to an unintended host.
- CVE-2026-16221High
Vulnerability in fast-uri library (versions 2.3.1-4.1.0, 3.x up to 3.1.3, 2.x up to 2.4.2). Backslash is not treated as an authority delimiter, while Node's parser normalizes it to slash. Parsing discrepancy can bypass host-based policies (allowlists, SSRF filtering).
- CVE-2026-13676High
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. This causes discrepancies between fast-uri and Node's native URL parser, potentially bypassing host-based policies.
- CVE-2026-6322High
In fast-uri versions up to 3.1.1, the normalize() function decoded percent-encoded authority delimiters inside the host component and re-emitted them as raw delimiters during serialization. This allows an attacker to change the URI authority to a different domain than the input appeared to specify.
- CVE-2026-6321High
In the fast-uri library, the normalize() and equal() functions decoded percent-encoded path separators and dot segments before applying dot-segment removal. Encoded path data was treated as real slashes and parent-directory references, causing distinct URIs to collapse onto the same normalized path. Versions up to 3.1.0 are affected.
Original NVD description (English source)
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.