CVE-2026-76172
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The fast-uri URI parser for Node.js mishandles schemes with percent-encoded slashes, allowing an attacker to manipulate the host and bypass allowlists. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
Risk Assessment
Applications using fast-uri for host validation can be tricked, leading to off-site redirects, SSRF, or address-policy bypass.
Recommendation
Upgrade fast-uri to 2.4.5, 3.1.6, or 4.1.3, which reject invalid schemes after decoding.
Other vulnerabilities in fast-uri
See all- CVE-2026-75975High
The fast-uri URI parser for Node.js incorrectly validates bracketed IPv6 literals, allowing a malicious host to be transformed into a different IPv6 destination, such as loopback or private address. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-75931High
The fast-uri URI parser for Node.js does not canonicalize the host in scheme-relative references, leading to inconsistencies between parse, resolve, normalize, and equal functions. Affected versions are 2.4.2 up to 2.4.4, 3.1.3 up to 3.1.5, and 4.0.1 up to 4.1.2.
- CVE-2026-75899High
The fast-uri URI parser for Node.js decodes percent escapes in the hostname twice, potentially changing the destination to loopback or another internal address. Affected versions are 2.4.1 up to 2.4.4, 3.1.2 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-18446High
The fast-uri library before versions 4.1.2, 3.1.5, and 2.4.4 incorrectly parses URIs when a backslash is used instead of a double forward slash. Node.js treats backslash as interchangeable with forward slash, leading to differences in host parsing. Applications using fast-uri for host-based policy enforcement can be steered to an unintended host.
- CVE-2026-16221High
Vulnerability in fast-uri library (versions 2.3.1-4.1.0, 3.x up to 3.1.3, 2.x up to 2.4.2). Backslash is not treated as an authority delimiter, while Node's parser normalizes it to slash. Parsing discrepancy can bypass host-based policies (allowlists, SSRF filtering).
- CVE-2026-13676High
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. This causes discrepancies between fast-uri and Node's native URL parser, potentially bypassing host-based policies.
- CVE-2026-6322High
In fast-uri versions up to 3.1.1, the normalize() function decoded percent-encoded authority delimiters inside the host component and re-emitted them as raw delimiters during serialization. This allows an attacker to change the URI authority to a different domain than the input appeared to specify.
- CVE-2026-6321High
In the fast-uri library, the normalize() and equal() functions decoded percent-encoded path separators and dot segments before applying dot-segment removal. Encoded path data was treated as real slashes and parent-directory references, causing distinct URIs to collapse onto the same normalized path. Versions up to 3.1.0 are affected.
Original NVD description (English source)
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.