{"id":"CVE-2026-75975","aliases":["ALSA-2026:71543","CLSA-2026-1784769612","CLSA-2026-1788432470","CLSA-2026-1790016280","CLSA-2026-1790604828","CLSA-2026-1790854656","CLSA-2026-1790856985","CLSA-2026-1790862941","CLSA-2026-1791629263","CLSA-2026-1792143884","DEBIAN-CVE-2026-75975","EUVD-2026-64772","GHSA-f65p-4m7j-42xc","RHSA-2026:60855","RHSA-2026:60856","RHSA-2026:60866","RHSA-2026:71543","RHSA-2026:74503","RLSA-2026:71543","ROOT-APP-NPM-CVE-2026-75975","UBUNTU-CVE-2026-75975"],"status":"published","title":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0022,"percentile":0.12633,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-918"],"published":"2026-08-04T14:52:48Z","modified":"2026-10-29T11:30:49Z","fixes":[{"ecosystem":"npm","package":"fast-uri","fixed_in":["2.4.5","3.1.6","4.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-ajv","fixed_in":["8.20.0~ds+~cs7.1.4-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"fast-uri","fixed_in":["3.0.2-aikido.6","3.1.0-aikido.6","3.0.6-aikido.5","3.1.5-aikido.1","3.1.2-aikido.3","3.0.1-aikido.6","3.0.1-aikido.7","3.1.5-aikido.2","3.0.6-aikido.6","3.0.3-aikido.6","3.0.3-aikido.7","3.0.1-aikido.8","3.0.3-aikido.8","3.1.2-aikido.4","3.0.3-aikido.9","4.1.3-aikido.1","4.1.3-aikido.2","3.1.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/fast-uri","fixed_in":["3.0.2-root.io.6","3.1.0-root.io.6","3.0.6-root.io.5","3.1.5-root.io.1","3.1.2-root.io.3","3.0.1-root.io.6","3.0.1-root.io.7","3.1.5-root.io.2","3.0.6-root.io.6","3.0.3-root.io.6","3.0.3-root.io.7","3.0.1-root.io.8","3.0.3-root.io.8","3.1.2-root.io.4","3.0.3-root.io.9","4.1.3-root.io.1","4.1.3-root.io.2","3.1.6-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1"},{"fixed":"2.4.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"94.4-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-tuxcare.0"},{"fixed":"2.4.2-tuxcare.1"}]}],"versions":["2.4.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3-tuxcare.0"},{"fixed":"2.4.3-tuxcare.2"}]}],"versions":["2.4.3","2.4.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.3"}]}],"versions":["3.0.3","3.0.3-tuxcare.1","3.0.3-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4-tuxcare.0"},{"fixed":"3.1.4-tuxcare.1"}]}],"versions":["3.1.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.1"}]}],"versions":["3.1.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.1"}]}],"versions":["3.1.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.5-tuxcare.0"},{"fixed":"3.1.5-tuxcare.2"}]}],"versions":["3.1.5","3.1.5-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.2"}]}],"versions":["3.1.0","3.1.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6-tuxcare.0"},{"fixed":"3.0.6-tuxcare.2"}]}],"versions":["3.0.6","3.0.6-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"Debian:13","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.12.0~ds+~2.1.1-5","8.17.1~ds+~3.0.1+~3.1.0-1","8.17.1~ds+~3.0.1+~3.1.0-2","8.17.1~ds+~3.0.1+~3.1.0-3","8.17.1~ds+~3.0.1+~3.1.0-4","8.18.0~ds+~cs6.1.1-1","8.18.0~ds+~cs6.1.1-2","8.20.0~ds+~cs6.1.3-1","8.20.0~ds+~cs7.1.2-1","8.20.0~ds+~cs7.1.3-1","8.20.0~ds+~cs7.1.3-2","8.20.0~ds+~cs7.1.3-3","8.20.0~ds+~cs7.1.4-1","8.20.0~ds+~cs7.1.5-1","8.20.0~ds+~cs7.1.6-1","8.20.0~ds+~cs7.1.6-2"]},{"source":"osv","ecosystem":"Debian:14","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.0~ds+~cs7.1.4-1"}]}],"versions":["8.12.0~ds+~2.1.1-5","8.17.1~ds+~3.0.1+~3.1.0-1","8.17.1~ds+~3.0.1+~3.1.0-2","8.17.1~ds+~3.0.1+~3.1.0-3","8.17.1~ds+~3.0.1+~3.1.0-4","8.18.0~ds+~cs6.1.1-1","8.18.0~ds+~cs6.1.1-2","8.20.0~ds+~cs6.1.3-1","8.20.0~ds+~cs7.1.2-1","8.20.0~ds+~cs7.1.3-1","8.20.0~ds+~cs7.1.3-2","8.20.0~ds+~cs7.1.3-3"]},{"source":"osv","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"2.3.1"},{"fixed":"2.4.5"}]}]},{"source":"osv","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.1.6"}]}]},{"source":"osv","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.3.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.0-0.1.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.9-0.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:94.4-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.3-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.3-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.20.0.11-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Rocky Linux:10","package":"cockpit-image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:94.4-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-aikido.6"},{"fixed":"3.1.0-aikido.6"},{"fixed":"3.0.6-aikido.5"},{"fixed":"3.1.5-aikido.1"},{"fixed":"3.1.2-aikido.3"},{"fixed":"3.0.1-aikido.6"},{"fixed":"3.0.1-aikido.7"},{"fixed":"3.1.5-aikido.2"},{"fixed":"3.0.6-aikido.6"},{"fixed":"3.0.3-aikido.6"},{"fixed":"3.0.3-aikido.7"},{"fixed":"3.0.1-aikido.8"},{"fixed":"3.0.3-aikido.8"},{"fixed":"3.1.2-aikido.4"},{"fixed":"3.0.3-aikido.9"},{"fixed":"4.1.3-aikido.1"},{"fixed":"4.1.3-aikido.2"},{"fixed":"3.1.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-root.io.6"},{"fixed":"3.1.0-root.io.6"},{"fixed":"3.0.6-root.io.5"},{"fixed":"3.1.5-root.io.1"},{"fixed":"3.1.2-root.io.3"},{"fixed":"3.0.1-root.io.6"},{"fixed":"3.0.1-root.io.7"},{"fixed":"3.1.5-root.io.2"},{"fixed":"3.0.6-root.io.6"},{"fixed":"3.0.3-root.io.6"},{"fixed":"3.0.3-root.io.7"},{"fixed":"3.0.1-root.io.8"},{"fixed":"3.0.3-root.io.8"},{"fixed":"3.1.2-root.io.4"},{"fixed":"3.0.3-root.io.9"},{"fixed":"4.1.3-root.io.1"},{"fixed":"4.1.3-root.io.2"},{"fixed":"3.1.6-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.12.6-2","6.12.6-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.12.6-3","8.12.0~ds+~2.1.1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.17.1~ds+~3.0.1+~3.1.0-4build1","8.20.0~ds+~cs6.1.3-1","8.20.0~ds+~cs7.1.2-1","8.20.0~ds+~cs7.1.3-1","8.20.0~ds+~cs7.1.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.12.0~ds+~2.1.1-5","8.17.1~ds+~3.0.1+~3.1.0-2","8.17.1~ds+~3.0.1+~3.1.0-4build1"]}],"products":[{"vendor":"fast-uri","product":"fast-uri"},{"vendor":"openjsf","product":"fast-uri"}],"references":[{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc","tags":["Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75975","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.5","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.6","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f65p-4m7j-42xc"},{"url":"https://access.redhat.com/errata/RHSA-2026:71543","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75899","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75975","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76172","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84292","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521778","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521779","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521798","tags":["report"]},{"url":"https://bugzilla.redhat.com/2527747","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-71543.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75975.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-75975","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60855","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6322","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75931","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60855.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6322","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75899","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75931","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75975","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521798","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76172","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76172","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60856","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60856.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73501","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82562","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60866.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73501","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73501","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.144.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82562","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527747","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71543.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74503","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50183","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50184","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50185","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50187","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50584","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50904","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74503.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12405","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12423","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12423","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489969","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12540","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489970","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12541","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489971","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12542","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33154","tags":["advisory"]},{"url":"https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/releases/tag/3.2.13","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517527","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54284","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490543","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56098","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59879","tags":["advisory"]},{"url":"https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517523","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59893","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71491","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-79654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523348","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79654","tags":["advisory"]},{"url":"https://github.com/Katello/katello/pull/11847","tags":["article"]},{"url":"https://projects.theforeman.org/issues/39701","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84394","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87817","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530744","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96658","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536844","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96659","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:71543","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-75975","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-75975","title":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T09:58:07.698Z","modified":"2026-08-24T14:30:09.105Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-64772","description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T09:58:07Z","modified":"2026-08-24T14:30:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:34.936274Z"}],"ghsa":[{"id":"GHSA-f65p-4m7j-42xc","title":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","description":"### Impact\n\n`fast-uri` does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, `normalize('http://[::not-valid]/private')` returns `http://[::]/private`, and `[fc00::not-hex]` and `[fe80::not-hex]` collapse to `[fc00::]` and `[fe80::]`. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (`::1`), unique-local, or link-local. Because `parse().error` is unset for these inputs, checking it does not protect the consumer.\n\n### Patches\n\nUpgrade to `fast-uri` 2.4.5, 3.1.6, or 4.1.3. Malformed IPv6 literals are now rejected with a host error instead of being normalized to a valid address.\n\n### Workarounds\n\nReject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`, or route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.","status":"published","published":"2026-09-02T15:43:30Z","modified":"2026-09-02T15:43:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-75975","description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T10:16:40.237Z","modified":"2026-10-14T13:10:00.187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:12:41.018848Z"}],"osv":[{"id":"CVE-2026-75975","title":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T09:58:07.698Z","modified":"2026-10-28T02:30:24.658464819Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-75975","description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T10:16:40.237Z","modified":"2026-10-15T10:03:23.039476097Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"GHSA-f65p-4m7j-42xc","title":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","description":"### Impact\n\n`fast-uri` does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, `normalize('http://[::not-valid]/private')` returns `http://[::]/private`, and `[fc00::not-hex]` and `[fe80::not-hex]` collapse to `[fc00::]` and `[fe80::]`. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (`::1`), unique-local, or link-local. Because `parse().error` is unset for these inputs, checking it does not protect the consumer.\n\n### Patches\n\nUpgrade to `fast-uri` 2.4.5, 3.1.6, or 4.1.3. Malformed IPv6 literals are now rejected with a host error instead of being normalized to a valid address.\n\n### Workarounds\n\nReject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`, or route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.","status":"published","published":"2026-09-02T15:43:30Z","modified":"2026-09-10T03:51:15.292437844Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"RHSA-2026:60855","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-30T10:06:48Z","modified":"2026-10-20T10:12:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60856","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-30T10:06:49Z","modified":"2026-10-20T10:12:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60866","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-30T10:06:50Z","modified":"2026-10-20T10:12:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:71543","title":"Red Hat Security Advisory: cockpit-image-builder security update","status":"published","published":"2026-09-25T10:15:29Z","modified":"2026-10-20T10:14:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74503","title":"Red Hat Security Advisory: Satellite 6.19.5 Async Update","status":"published","published":"2026-10-02T10:25:57Z","modified":"2026-10-20T10:15:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:71543","title":"Important: cockpit-image-builder security update","description":"The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.\n\nSecurity Fix(es):\n\n* fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)\n\n* fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)\n\n* fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)\n\n* fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-25T12:09:37.504383Z","modified":"2026-09-25T12:30:02.736711368Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-75975","description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T10:16:00Z","modified":"2026-10-17T13:01:05.966533656Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"ALSA-2026:71543","title":"Important: cockpit-image-builder security update","description":"The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.  \n\nSecurity Fix(es):  \n\n  * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)\n  * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)\n  * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)\n  * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-10-29T11:30:49.617876834Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1784769612","title":"TuxCare security update for fast-uri (6 CVEs)","description":"TuxCare rebuilt fast-uri to address 6 CVEs. Fixed in 2.4.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:36.429669264Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1788432470","title":"TuxCare security update for fast-uri (4 CVEs)","description":"TuxCare rebuilt fast-uri to address 4 CVEs. Fixed in 2.4.3-tuxcare.2.","status":"published","published":"2026-09-03T10:47:50Z","modified":"2026-10-15T09:48:03.1444326Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790016280","title":"TuxCare security update for fast-uri (3 CVEs)","description":"TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.0.3-tuxcare.3.","status":"published","published":"2026-09-21T18:44:40Z","modified":"2026-10-15T09:47:14.552239135Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790604828","title":"TuxCare security update for fast-uri (5 CVEs)","description":"TuxCare rebuilt fast-uri to address 5 CVEs. Fixed in 3.1.4-tuxcare.1.","status":"published","published":"2026-09-28T14:13:48Z","modified":"2026-10-15T09:48:03.133317375Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790854656","title":"TuxCare security update for fast-uri (2 CVEs)","description":"TuxCare rebuilt fast-uri to address 2 CVEs. Fixed in 3.1.3-tuxcare.1.","status":"published","published":"2026-10-01T11:37:36Z","modified":"2026-10-15T09:47:41.93152624Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790856985","title":"TuxCare security update for fast-uri (2 CVEs)","description":"TuxCare rebuilt fast-uri to address 2 CVEs. Fixed in 3.1.2-tuxcare.1.","status":"published","published":"2026-10-01T12:16:25Z","modified":"2026-10-15T09:47:57.720566452Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790862941","title":"TuxCare security update for fast-uri (3 CVEs)","description":"TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.1.5-tuxcare.2.","status":"published","published":"2026-10-01T13:55:40Z","modified":"2026-10-15T09:47:59.91732379Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791629263","title":"TuxCare security update for fast-uri (3 CVEs)","description":"TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.1.0-tuxcare.2.","status":"published","published":"2026-10-10T10:47:43Z","modified":"2026-10-15T09:48:04.611355608Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792143884","title":"TuxCare security update for fast-uri (7 CVEs)","description":"TuxCare rebuilt fast-uri to address 7 CVEs. Fixed in 3.0.6-tuxcare.2.","status":"published","published":"2026-10-16T09:44:44Z","modified":"2026-10-16T12:15:03.199589181Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"ROOT-APP-NPM-CVE-2026-75975","title":"CVE-2026-75975 in fast-uri - Patched by Root","description":"Root has patched CVE-2026-75975 in the fast-uri package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-07T15:32:18Z","modified":"2026-10-07T16:15:04.092322223Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}