What is the CVSS score of CVE-2026-75931?

CVE-2026-75931 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of fast-uri are affected by CVE-2026-75931?

fast-uri, a Node.js URI parser library used in Fastify applications, contains a host confusion vulnerability (CVSS 7.5) that could allow attackers to bypass security policies by exploiting…. A patch is available.

Is there a public PoC exploit available for CVE-2026-75931?

Yes, a public proof-of-concept exploit is available for CVE-2026-75931. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-75931?

Within 24 hours, identify all internal and third-party applications using fast-uri and assess which rely on URI-based policy validation for security decisions. Within 7 days, upgrade fast-uri to patched versions (2.4.5 for the 2.x line, 3.1.6 for the 3.x line, or 4.1.3 for the 4.x line) across all affected applications and redeploy. Within 30 days, conduct security testing of URI validation logic in affected applications to confirm the bypass vector is closed and no residual policy violations remain.

fast-uri CVE-2026-75931

EUVD-2026-64758 HIGH

Interpretation Conflict (CWE-436)

2026-08-24 openjs

GHSA-5jgf-p345-68v8

Authentication Bypass Node.js Red Hat Suse Fast Uri

7.5

CVSS 3.1 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.9 MEDIUM

AC:H reflects the required application-pattern precondition (two-step validate-then-resolve with scheme-relative input); all other metrics match the supplied vector.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 10:23 vuln.today

Patch available

Aug 24, 2026 - 10:02 EUVD

CVE Published

Aug 24, 2026 - 09:30 cve.org

HIGH 7.5

DescriptionCVE.org

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a patched version.

Articles & Coverage 2

News 5 New Node.js Vulnerabilities - 5 High Severity, No Public POC Aug 25, 2026 News 3 New Node.js Vulnerabilities - 3 High Severity Aug 24, 2026

AnalysisAI

Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.

Technical ContextAI

fast-uri (CPE: cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:*) is the URI parsing library used by the Fastify Node.js web framework ecosystem. The root cause is CWE-436 (Interpretation Conflict): the library's host-normalization logic is applied conditionally - only when an explicit URI scheme (e.g., 'https://') is present. Scheme-relative references that begin with '//' are valid per RFC 3986 and carry a host component but no scheme token. Because fast-uri's canonicalization gate checks for the scheme token, these references bypass the ASCII/Punycode conversion step. The resulting inconsistency between parse/equal and resolve means the library produces two logically distinct host strings for the same input depending on which internal code path is exercised. This violates the principle of consistent interpretation required for safe input validation and is the canonical pattern described by CWE-436.

RemediationAI

Vendor-released patches are available: upgrade fast-uri to version 2.4.5, 3.1.6, or 4.1.3 depending on the currently installed major/minor branch. These releases canonicalize the host consistently across the resolve path, eliminating the inconsistency. Upgrade instructions and release notes are in the GitHub Security Advisory at https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8. If immediate upgrade is not feasible, a compensating control is to reject scheme-relative URIs (those beginning with '//' but lacking an explicit scheme) at the application's input boundary before they reach fast-uri, using an explicit scheme-presence check. This workaround prevents the triggering input class from entering the library but may break legitimate use cases if scheme-relative references are intentionally supported. A second compensating control is to normalize all incoming URIs to include an explicit scheme before passing them to fast-uri, ensuring the canonicalization code path is always exercised. Neither workaround eliminates the underlying bug and both require application-layer code changes; patching is strongly preferred.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-436 – Interpretation Conflict

View all

CVE-2026-63030 CRITICAL POC

9.8

CVE-2024-24754 CRITICAL POC

9.8

CVE-2023-24813 CRITICAL POC

9.8

CVE-2019-19589 CRITICAL POC

9.8

CVE-2025-12816 HIGH POC

8.6

CVE-2026-67201 HIGH POC

7.7

CVE-2026-13676 HIGH POC

7.5

CVE-2026-14643 HIGH POC

7.5

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.4	Not-Affected

CVE-2026-75931 vulnerability details – vuln.today

Back

fast-uri CVE-2026-75931

Severity by source

CVSS VectorVendor: openjs

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 2

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-436 – Interpretation Conflict

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code