{"id":"CVE-2026-76172","aliases":["ALSA-2026:71543","CLSA-2026-1784769612","CLSA-2026-1788432470","CLSA-2026-1790016280","CLSA-2026-1790604828","CLSA-2026-1790862941","CLSA-2026-1790863104","CLSA-2026-1790876894","CLSA-2026-1791814871","CLSA-2026-1792143884","DEBIAN-CVE-2026-76172","EUVD-2026-64773","GHSA-jqff-g426-hqxp","RHSA-2026:60855","RHSA-2026:60856","RHSA-2026:60866","RHSA-2026:71543","RLSA-2026:71543","ROOT-APP-NPM-CVE-2026-76172","UBUNTU-CVE-2026-76172"],"status":"published","title":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00232,"percentile":0.14149,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-177"],"published":"2026-08-04T14:52:48Z","modified":"2026-10-29T11:30:49Z","fixes":[{"ecosystem":"npm","package":"fast-uri","fixed_in":["2.4.5","3.1.6","4.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-ajv","fixed_in":["8.20.0~ds+~cs7.1.4-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"fast-uri","fixed_in":["3.0.2-aikido.6","3.1.0-aikido.6","3.0.6-aikido.5","3.1.5-aikido.1","3.1.2-aikido.3","3.0.1-aikido.7","3.1.5-aikido.2","3.0.6-aikido.6","3.0.3-aikido.7","3.0.1-aikido.8","3.0.3-aikido.8","3.1.2-aikido.4","3.0.3-aikido.9","4.1.3-aikido.1","4.1.3-aikido.2","3.1.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/fast-uri","fixed_in":["3.0.2-root.io.6","3.1.0-root.io.6","3.0.6-root.io.5","3.1.5-root.io.1","3.1.2-root.io.3","3.0.1-root.io.7","3.1.5-root.io.2","3.0.6-root.io.6","3.0.3-root.io.7","3.0.1-root.io.8","3.0.3-root.io.8","3.1.2-root.io.4","3.0.3-root.io.9","4.1.3-root.io.1","4.1.3-root.io.2","3.1.6-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1"},{"fixed":"2.4.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"94.4-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-tuxcare.0"},{"fixed":"2.4.2-tuxcare.1"}]}],"versions":["2.4.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3-tuxcare.0"},{"fixed":"2.4.3-tuxcare.2"}]}],"versions":["2.4.3","2.4.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.3"}]}],"versions":["3.0.3","3.0.3-tuxcare.1","3.0.3-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4-tuxcare.0"},{"fixed":"3.1.4-tuxcare.1"}]}],"versions":["3.1.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.5-tuxcare.0"},{"fixed":"3.1.5-tuxcare.2"}]}],"versions":["3.1.5","3.1.5-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.2"}]}],"versions":["3.1.3","3.1.3-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.2"}]}],"versions":["3.1.2","3.1.2-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.3"}]}],"versions":["3.1.0","3.1.0-tuxcare.1","3.1.0-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6-tuxcare.0"},{"fixed":"3.0.6-tuxcare.2"}]}],"versions":["3.0.6","3.0.6-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"Debian:13","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.12.0~ds+~2.1.1-5","8.17.1~ds+~3.0.1+~3.1.0-1","8.17.1~ds+~3.0.1+~3.1.0-2","8.17.1~ds+~3.0.1+~3.1.0-3","8.17.1~ds+~3.0.1+~3.1.0-4","8.18.0~ds+~cs6.1.1-1","8.18.0~ds+~cs6.1.1-2","8.20.0~ds+~cs6.1.3-1","8.20.0~ds+~cs7.1.2-1","8.20.0~ds+~cs7.1.3-1","8.20.0~ds+~cs7.1.3-2","8.20.0~ds+~cs7.1.3-3","8.20.0~ds+~cs7.1.4-1","8.20.0~ds+~cs7.1.5-1","8.20.0~ds+~cs7.1.6-1","8.20.0~ds+~cs7.1.6-2"]},{"source":"osv","ecosystem":"Debian:14","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.0~ds+~cs7.1.4-1"}]}],"versions":["8.12.0~ds+~2.1.1-5","8.17.1~ds+~3.0.1+~3.1.0-1","8.17.1~ds+~3.0.1+~3.1.0-2","8.17.1~ds+~3.0.1+~3.1.0-3","8.17.1~ds+~3.0.1+~3.1.0-4","8.18.0~ds+~cs6.1.1-1","8.18.0~ds+~cs6.1.1-2","8.20.0~ds+~cs6.1.3-1","8.20.0~ds+~cs7.1.2-1","8.20.0~ds+~cs7.1.3-1","8.20.0~ds+~cs7.1.3-2","8.20.0~ds+~cs7.1.3-3"]},{"source":"osv","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"2.3.1"},{"fixed":"2.4.5"}]}]},{"source":"osv","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.1.6"}]}]},{"source":"osv","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.3.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.0-0.1.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.9-0.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:94.4-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"cockpit-image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:94.4-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-aikido.6"},{"fixed":"3.1.0-aikido.6"},{"fixed":"3.0.6-aikido.5"},{"fixed":"3.1.5-aikido.1"},{"fixed":"3.1.2-aikido.3"},{"fixed":"3.0.1-aikido.7"},{"fixed":"3.1.5-aikido.2"},{"fixed":"3.0.6-aikido.6"},{"fixed":"3.0.3-aikido.7"},{"fixed":"3.0.1-aikido.8"},{"fixed":"3.0.3-aikido.8"},{"fixed":"3.1.2-aikido.4"},{"fixed":"3.0.3-aikido.9"},{"fixed":"4.1.3-aikido.1"},{"fixed":"4.1.3-aikido.2"},{"fixed":"3.1.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-root.io.6"},{"fixed":"3.1.0-root.io.6"},{"fixed":"3.0.6-root.io.5"},{"fixed":"3.1.5-root.io.1"},{"fixed":"3.1.2-root.io.3"},{"fixed":"3.0.1-root.io.7"},{"fixed":"3.1.5-root.io.2"},{"fixed":"3.0.6-root.io.6"},{"fixed":"3.0.3-root.io.7"},{"fixed":"3.0.1-root.io.8"},{"fixed":"3.0.3-root.io.8"},{"fixed":"3.1.2-root.io.4"},{"fixed":"3.0.3-root.io.9"},{"fixed":"4.1.3-root.io.1"},{"fixed":"4.1.3-root.io.2"},{"fixed":"3.1.6-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.12.6-2","6.12.6-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.12.6-3","8.12.0~ds+~2.1.1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.17.1~ds+~3.0.1+~3.1.0-4build1","8.20.0~ds+~cs6.1.3-1","8.20.0~ds+~cs7.1.2-1","8.20.0~ds+~cs7.1.3-1","8.20.0~ds+~cs7.1.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.12.0~ds+~2.1.1-5","8.17.1~ds+~3.0.1+~3.1.0-2","8.17.1~ds+~3.0.1+~3.1.0-4build1"]}],"products":[{"vendor":"fast-uri","product":"fast-uri"},{"vendor":"openjsf","product":"fast-uri"}],"references":[{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76172","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.5","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.6","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jqff-g426-hqxp"},{"url":"https://access.redhat.com/errata/RHSA-2026:71543","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75899","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75975","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76172","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84292","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521778","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521779","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521798","tags":["report"]},{"url":"https://bugzilla.redhat.com/2527747","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-71543.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76172.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-76172","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60855","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6322","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75931","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60855.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6322","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75899","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75931","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75975","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521798","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76172","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60856","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60856.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73501","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82562","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60866.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73501","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73501","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.144.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82562","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527747","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71543.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:71543","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-76172","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-76172","title":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T10:07:56.44Z","modified":"2026-08-24T14:29:37.95Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T13:46:21.568011Z"}],"euvd":[{"id":"EUVD-2026-64773","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T10:07:56Z","modified":"2026-08-24T14:29:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:34.936274Z"}],"ghsa":[{"id":"GHSA-jqff-g426-hqxp","title":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","description":"### Impact\n\n`fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore introduce structure the original input did not contain.\n\nFor example, `%2f%2fevil.example:/pwn` parses with no authority (`parse().host` is `undefined`), but `resolve()` and `normalize()` return `//evil.example:/pwn`, which reparses with host `evil.example`. The `%uXXXX` form (`%u002f%u002fevil.example:/pwn`) produces the same result, and a scheme containing `%0d%0a` reaches the output as a raw CR LF.\n\nApplications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision, especially ones that treat a missing authority as same-origin, can be steered to an attacker-chosen authority, and a normalized URI placed in a response header can carry an injected CR LF.\n\n### Patches\n\nUpgrade to `fast-uri` \u003e= 4.1.3, or \u003e= 3.1.6 in the v3.x release line, or \u003e= 2.4.5 in the v2.x release line.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","status":"published","published":"2026-09-02T15:41:53Z","modified":"2026-09-02T15:41:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-76172","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T11:16:40.723Z","modified":"2026-10-14T13:10:00.187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T14:12:41.018848Z"}],"osv":[{"id":"CVE-2026-76172","title":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T10:07:56.44Z","modified":"2026-10-28T02:30:28.108693211Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-76172","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T11:16:40.723Z","modified":"2026-10-15T10:03:23.040951831Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"GHSA-jqff-g426-hqxp","title":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","description":"### Impact\n\n`fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore introduce structure the original input did not contain.\n\nFor example, `%2f%2fevil.example:/pwn` parses with no authority (`parse().host` is `undefined`), but `resolve()` and `normalize()` return `//evil.example:/pwn`, which reparses with host `evil.example`. The `%uXXXX` form (`%u002f%u002fevil.example:/pwn`) produces the same result, and a scheme containing `%0d%0a` reaches the output as a raw CR LF.\n\nApplications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision, especially ones that treat a missing authority as same-origin, can be steered to an attacker-chosen authority, and a normalized URI placed in a response header can carry an injected CR LF.\n\n### Patches\n\nUpgrade to `fast-uri` \u003e= 4.1.3, or \u003e= 3.1.6 in the v3.x release line, or \u003e= 2.4.5 in the v2.x release line.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","status":"published","published":"2026-09-02T15:41:53Z","modified":"2026-09-10T03:50:54.467662526Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"RHSA-2026:60855","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-30T10:06:48Z","modified":"2026-10-20T10:12:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60856","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-30T10:06:49Z","modified":"2026-10-20T10:12:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60866","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-30T10:06:50Z","modified":"2026-10-20T10:12:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:71543","title":"Red Hat Security Advisory: cockpit-image-builder security update","status":"published","published":"2026-09-25T10:15:29Z","modified":"2026-10-20T10:14:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:71543","title":"Important: cockpit-image-builder security update","description":"The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.\n\nSecurity Fix(es):\n\n* fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)\n\n* fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)\n\n* fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)\n\n* fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-25T12:09:37.504383Z","modified":"2026-09-25T12:30:02.736711368Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-76172","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","status":"published","published":"2026-08-24T11:16:00Z","modified":"2026-10-17T13:01:06.818106868Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"ALSA-2026:71543","title":"Important: cockpit-image-builder security update","description":"The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.  \n\nSecurity Fix(es):  \n\n  * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)\n  * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)\n  * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)\n  * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-10-29T11:30:49.617876834Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1784769612","title":"TuxCare security update for fast-uri (6 CVEs)","description":"TuxCare rebuilt fast-uri to address 6 CVEs. Fixed in 2.4.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:36.429669264Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1788432470","title":"TuxCare security update for fast-uri (4 CVEs)","description":"TuxCare rebuilt fast-uri to address 4 CVEs. Fixed in 2.4.3-tuxcare.2.","status":"published","published":"2026-09-03T10:47:50Z","modified":"2026-10-15T09:48:03.1444326Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790016280","title":"TuxCare security update for fast-uri (3 CVEs)","description":"TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.0.3-tuxcare.3.","status":"published","published":"2026-09-21T18:44:40Z","modified":"2026-10-15T09:47:14.552239135Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790604828","title":"TuxCare security update for fast-uri (5 CVEs)","description":"TuxCare rebuilt fast-uri to address 5 CVEs. Fixed in 3.1.4-tuxcare.1.","status":"published","published":"2026-09-28T14:13:48Z","modified":"2026-10-15T09:48:03.133317375Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790862941","title":"TuxCare security update for fast-uri (3 CVEs)","description":"TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.1.5-tuxcare.2.","status":"published","published":"2026-10-01T13:55:40Z","modified":"2026-10-15T09:47:59.91732379Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790863104","title":"TuxCare security update for fast-uri (2 CVEs)","description":"TuxCare rebuilt fast-uri to address 2 CVEs. Fixed in 3.1.3-tuxcare.2.","status":"published","published":"2026-10-01T13:58:24Z","modified":"2026-10-15T09:48:04.016731974Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790876894","title":"TuxCare security update for fast-uri (3 CVEs)","description":"TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.1.2-tuxcare.2.","status":"published","published":"2026-10-01T17:48:14Z","modified":"2026-10-15T09:48:04.328063614Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791814871","title":"TuxCare security update for fast-uri (5 CVEs)","description":"TuxCare rebuilt fast-uri to address 5 CVEs. Fixed in 3.1.0-tuxcare.3.","status":"published","published":"2026-10-12T14:21:11Z","modified":"2026-10-15T09:47:40.140546262Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792143884","title":"TuxCare security update for fast-uri (7 CVEs)","description":"TuxCare rebuilt fast-uri to address 7 CVEs. Fixed in 3.0.6-tuxcare.2.","status":"published","published":"2026-10-16T09:44:44Z","modified":"2026-10-16T12:15:03.199589181Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"ROOT-APP-NPM-CVE-2026-76172","title":"CVE-2026-76172 in fast-uri - Patched by Root","description":"Root has patched CVE-2026-76172 in the fast-uri package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-07T15:32:18Z","modified":"2026-10-07T16:15:04.203065408Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}