URI Parsing Flaw in fast-uri Affects Node.js Applications

CVE-2026-76172

What is CVE-2026-76172?

The fast-uri package, a URI parser for Node.js, contains an improper input validation vulnerability during its parsing process. A legacy decoding pass over the scheme component leads to a situation where percent-encoded slashes are not re-escaped, allowing for potential attacker manipulation. This flaw results in parsed hosts being undefined, setting the stage for types of attacks such as off-site redirects and server-side request forgery. Additionally, the decoder can handle non-standard escape forms, expanding the attack surface beyond upstream filters. It is crucial for users operating affected versions (2.3.1 < 2.4.5, 3.0.0 < 3.1.6, 4.0.0 < 4.1.3) to update to patched versions to safeguard their applications.

References