CVE-2026-75899
Received Received - Intake

Double Decode Hostname Bypass in fast-uri

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: openjs

Description
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-75899
EUVD
EUVD-2026-64763

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-174 The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the fast-uri library allows server-side request forgery (SSRF) by double-decoding percent-encoded hostnames. During URI parsing and recomposition, the library decodes percent escapes twice, transforming nested encoded input into unintended destinations like loopback addresses. For example, a doubly encoded host can decode to 'localhost' after processing.

Detection Guidance

To detect this vulnerability, check if your system uses an affected version of fast-uri (2.4.1-2.4.4, 3.1.2-3.1.5, or 4.0.0-4.1.2). Run commands like 'npm list fast-uri' or 'npm list -g fast-uri' to check installed versions. If the version is within the vulnerable range, the system is potentially affected.

Impact Analysis

An attacker could craft malicious URIs that bypass security checks, redirecting applications to unintended internal or external hosts. This may lead to unauthorized access to internal services, data exfiltration, or SSRF attacks. Applications normalizing or resolving untrusted URIs before routing or validation are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade fast-uri to a patched version (2.4.5, 3.1.6, or 4.1.3) immediately. If upgrading is not possible, implement a workaround by rejecting any untrusted URI containing an encoded percent sign (%25) in the host component before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart