CVE-2026-75899

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.1 through 2.4.4 fast-uri versions 3.1.2 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2

Description This URI parser for Node.js decodes percent escapes in a hostname during parsing and subsequently decodes the parsed hostname a second time during authority recomposition. This double decoding allows nested percent-encoded input to be transformed into a different network destination, such as a loopback hostname or address, which violates RFC 3986 section 2.4. Applications that normalize or resolve untrusted HTTP-family URIs before outbound routing, redirect validation, or host-policy checks may be susceptible to server-side request forgery (SSRF) and host-policy bypass.

Recommendations Update versions 2.4.1 through 2.4.4 to 2.4.5. Update versions 3.1.2 through 3.1.5 to 3.1.6. Update versions 4.0.0 through 4.1.2 to 4.1.3.