CVE-2026-75975

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 2.4.4 fast-uri versions 3.0.0 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2

Description The custom parser for bracketed IPv6 literals fails to validate the complete IPv6 grammar. This allows invalid trailing text in an authority to be silently discarded, causing a malformed attacker-controlled host to be converted into a different valid IPv6 destination. For instance, literals with invalid trailing characters may be normalized to the unspecified address, leading a Node HTTP client to connect to a local service over loopback, while other malformed literals may collapse to private-range addresses. Because no error is set on the parsed result, applications cannot detect this rewrite. This can lead to server-side request forgery (SSRF) and address-policy bypass when an application normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement.

Recommendations Update to version 2.4.5 or later. Update to version 3.1.6 or later. Update to version 4.1.3 or later.