URI Parsing Vulnerability in fast-uri by Fastify

CVE-2026-75899

What is CVE-2026-75899?

The fast-uri library for Node.js has a vulnerability that allows nested percent-encoded input in URI to be decoded multiple times, potentially leading to server-side request forgery and host-policy bypass. This occurs because the library decodes percent escapes during hostname parsing and again during authority recomposition, which can redirect an application to unintended destinations. Applications using untrusted HTTP-family URIs are especially at risk. Users are advised to upgrade to the patched versions of fast-uri to mitigate this issue and ensure compliance with the relevant RFC standards.

References