Npm · Fast-Uri · CVE-2026-75899
**Name of the Vulnerable Software and Affected Versions**
fast-uri versions 2.4.1 through 2.4.4
fast-uri versions 3.1.2 through 3.1.5
fast-uri versions 4.0.0 through 4.1.2
**Description**
This URI parser for Node.js decodes percent escapes in a hostname during parsing and subsequently decodes the parsed hostname a second time during authority recomposition. This double decoding allows nested percent-encoded input to be transformed into a different network destination, such as a loopback hostname or address, which violates RFC 3986 section 2.4. Applications that normalize or resolve untrusted HTTP-family URIs before outbound routing, redirect validation, or host-policy checks may be susceptible to server-side request forgery (SSRF) and host-policy bypass.
**Recommendations**
Update versions 2.4.1 through 2.4.4 to 2.4.5.
Update versions 3.1.2 through 3.1.5 to 3.1.6.
Update versions 4.0.0 through 4.1.2 to 4.1.3.