CVE-2026-75975
Received Received - Intake

IPv6 Parsing Flaw in fast-uri Library

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: openjs

Description
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-75975
EUVD
EUVD-2026-64772

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
fast_uri fast_uri From 2.3.1 (inc) to 2.4.5 (exc)
fast_uri fast_uri From 3.0.0 (inc) to 3.1.6 (exc)
fast_uri fast_uri From 4.0.0 (inc) to 4.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the fast-uri library in Node.js, which improperly validates IPv6 literals in URLs. Malformed IPv6 addresses with invalid trailing text are silently converted into valid but unintended addresses, such as loopback or private-range addresses. This can redirect requests to unauthorized destinations without raising errors.

Detection Guidance

To detect this vulnerability, inspect applications using fast-uri versions 2.3.1 to 2.4.4, 3.0.0 to 3.1.5, or 4.0.0 to 4.1.2. Check for malformed IPv6 literals in URLs, such as trailing invalid text in bracketed addresses like [::not-valid]. Use commands to list installed versions: npm list fast-uri or grep fast-uri package.json. Monitor logs for unexpected connections to loopback or private IPv6 addresses.

Impact Analysis

An attacker could exploit this to bypass address policies, redirect requests to local services, or access private networks. Applications normalizing untrusted URLs before outbound requests are at risk of server-side request forgery, potentially leading to data leaks or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using vulnerable versions may face compliance breaches due to potential server-side request forgery attacks.

Mitigation Strategies

Upgrade fast-uri to patched versions 2.4.5, 3.1.6, or 4.1.3 immediately. If upgrading is not possible, implement a workaround by rejecting untrusted URLs containing bracketed IPv6 literals before processing. Enforce allowlists for outbound requests to prevent redirection to unintended addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75975. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart