CVE-2026-76172

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 2.4.4 fast-uri versions 3.0.0 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2

Description During URI parsing, the software performs a legacy decoding pass on the scheme component without re-escaping the result. When serialization occurs, the scheme is written verbatim. If an input scheme contains percent-encoded slashes, it is parsed as having no authority, leaving the host and error as undefined. However, resolving or normalizing this input produces a network-path reference with an attacker-controlled authority. This can lead to server-side request forgery, off-site redirects, or address-policy bypass if an application relies on the parsed host for allowlisting or assumes a reference without authority is safe. Additionally, the legacy decoder expands non-standard escape forms and allows control characters in the scheme to be output as raw carriage returns and line feeds.

Recommendations Update fast-uri versions 2.3.1 through 2.4.4 to version 2.4.5. Update fast-uri versions 3.0.0 through 3.1.5 to version 3.1.6. Update fast-uri versions 4.0.0 through 4.1.2 to version 4.1.3.