URI Parser Vulnerability in fast-uri for Node.js
CVE-2026-75975

7.5HIGH

Key Information:

Vendor

Fast-uri

Status
Fast-uri
Vendor
CVE Published:
24 August 2026

What is CVE-2026-75975?

The fast-uri library for Node.js contains a vulnerability in its handling of bracketed IPv6 literals. The parser fails to fully validate the entire IPv6 grammar, resulting in invalid trailing text being ignored and potentially directing requests to unintended local or private IPv6 addresses. This behavior opens the door to server-side request forgery, as applications may unknowingly connect to malicious endpoints without triggering error alerts. Attackers can exploit this flaw by crafting unwanted redirects or manipulating address policies. Users are advised to upgrade to patched versions to mitigate these risks.

Affected Version(s)

fast-uri 2.3.1 < 2.4.5

fast-uri 3.0.0 < 3.1.6

fast-uri 4.0.0 < 4.1.3

References

https://github.com/fastify/fast-uri/security/advisories/G...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mcollina
UlisesGascon
.