--- id: CVE-2026-75899 title: fast-uri is a URI parser for Node.js summary: >- fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested per… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N' cwe: - CWE-174 - CWE-918 - CWE-140 vendor: openjsf product: fast-uri affected: - 'fast-uri >= 2.4.1, < 2.4.5' - 'fast-uri >= 3.1.2, < 3.1.6' - 'fast-uri >= 4.0.0, < 4.1.3' patched: - fast-uri 4.1.3 published: '2026-08-24' updated: '2026-10-14' sourceUpdated: '2026-10-14T13:10:00.187' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75899' references: - url: 'https://cna.openjsf.org/security-advisories.html' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: >- https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf label: ce714d77-add3-4f53-aff5-83d477b104bb - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75899.json - url: 'https://access.redhat.com/security/cve/CVE-2026-75899' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2521778' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-75899' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75899' - url: 'https://access.redhat.com/errata/RHSA-2026:74503' - url: 'https://access.redhat.com/errata/RHSA-2026:71543' - url: 'https://access.redhat.com/errata/RHSA-2026:74609' - url: 'https://access.redhat.com/errata/RHSA-2026:70593' - url: 'https://access.redhat.com/errata/RHSA-2026:67542' - url: 'https://access.redhat.com/errata/RHSA-2026:72880' - url: 'https://access.redhat.com/errata/RHSA-2026:67543' - url: 'https://access.redhat.com/errata/RHSA-2026:65118' - url: 'https://access.redhat.com/errata/RHSA-2026:65155' - url: 'https://access.redhat.com/errata/RHSA-2026:82151' - url: 'https://access.redhat.com/errata/RHSA-2026:71179' - url: 'https://access.redhat.com/errata/RHSA-2026:67279' - url: 'https://access.redhat.com/errata/RHSA-2026:79357' - url: 'https://access.redhat.com/errata/RHSA-2026:76788' - url: 'https://access.redhat.com/errata/RHSA-2026:79088' - url: 'https://access.redhat.com/errata/RHSA-2026:69248' - url: 'https://access.redhat.com/errata/RHSA-2026:61783' - url: 'https://access.redhat.com/errata/RHSA-2026:68044' - url: 'https://access.redhat.com/errata/RHSA-2026:68253' - url: 'https://access.redhat.com/errata/RHSA-2026:68006' - url: 'https://access.redhat.com/errata/RHSA-2026:68254' - url: 'https://access.redhat.com/errata/RHSA-2026:60866' - url: 'https://access.redhat.com/errata/RHSA-2026:60855' - url: 'https://access.redhat.com/errata/RHSA-2026:60856' - url: 'https://access.redhat.com/errata/RHSA-2026:68681' - url: 'https://access.redhat.com/errata/RHSA-2026:68547' - url: 'https://access.redhat.com/errata/RHSA-2026:68553' - url: 'https://access.redhat.com/errata/RHSA-2026:68754' - url: 'https://access.redhat.com/errata/RHSA-2026:68762' - url: 'https://access.redhat.com/errata/RHSA-2026:68756' - url: 'https://access.redhat.com/errata/RHSA-2026:68766' - url: 'https://access.redhat.com/errata/RHSA-2026:68748' - url: 'https://access.redhat.com/errata/RHSA-2026:68750' - url: 'https://access.redhat.com/errata/RHSA-2026:68747' - url: 'https://access.redhat.com/errata/RHSA-2026:68755' - url: >- https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f - url: >- https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304 - url: >- https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514 - url: 'https://github.com/fastify/fast-uri/releases/tag/v2.4.5' - url: 'https://github.com/fastify/fast-uri/releases/tag/v3.1.6' - url: 'https://github.com/fastify/fast-uri/releases/tag/v4.1.3' - url: 'https://github.com/advisories/GHSA-fph4-wmhf-6fwf' tags: - nvd - csaf - vex - red-hat - ghsa - npm epss: 0.0022 epssPercentile: 0.12456 aliases: - GHSA-fph4-wmhf-6fwf ecosystem: npm ingestedAt: '2026-09-02T15:46:29.268Z' --- ## Overview fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version. ## Affected - `fast-uri >= 2.4.1, < 2.4.5` - `fast-uri >= 3.1.2, < 3.1.6` - `fast-uri >= 4.0.0, < 4.1.3` ## Remediation Upgrade past the affected range: - `fast-uri 4.1.3` ## Package advisory (CVE-2026-75899) Affected packages: - `fast-uri >= 2.4.1, < 2.4.5` - `fast-uri >= 3.1.2, < 3.1.6` - `fast-uri >= 4.0.0, < 4.1.3` Patched in: - `fast-uri 2.4.5` - `fast-uri 3.1.6` - `fast-uri 4.1.3` Source: https://github.com/advisories/GHSA-fph4-wmhf-6fwf ## Vendor advisories - **RHSA-2026:74503** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74503) - **RHSA-2026:71543** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71543) - **RHSA-2026:74609** · Red Hat · fixed in: Cluster Observability Operator 1.5.3 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74609) - **RHSA-2026:70593** · Red Hat · fixed in: Network Observability (NETOBSERV) 1.12.3 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70593) - **RHSA-2026:67542** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67542) - **RHSA-2026:72880** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72880) - **RHSA-2026:67543** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67543) - **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118) - **RHSA-2026:65155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65155) - **RHSA-2026:82151** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82151) - **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179) - **Red Hat VEX** · Important · affected: OpenShift Lightspeed, OpenShift Pipelines, OpenShift Serverless, Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop, Red Hat Data Grid 8, … · no fix planned: Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, Red Hat Data Grid 8, Red Hat Enterprise Linux AI (RHEL AI) 3, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75899.json) - **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279) - **RHSA-2026:69248** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69248) - **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783) - **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044) - **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253) - **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006) - **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254) - **RHSA-2026:60866** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60866) - **RHSA-2026:60855** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60855) - **RHSA-2026:60856** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60856)