What is the CVSS score of CVE-2026-75975?

CVE-2026-75975 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of fast-uri are affected by CVE-2026-75975?

A flaw in fast-uri, the request-parsing library widely embedded in Node.js fastify web applications, allows unauthenticated attackers to covertly redirect application outbound requests to internal…. A patch is available.

Is there a public PoC exploit available for CVE-2026-75975?

Yes, a public proof-of-concept exploit is available for CVE-2026-75975. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-75975?

Within 24 hours, inventory all production services running fastify and identify external-facing applications that process untrusted URLs. Within 7 days, deploy strict URL input validation to reject IPv6 literals and non-standard address syntax, implement network segmentation restricting application egress to whitelisted endpoints only, and consider temporary WAF rules blocking requests with bracketed IPv6 formatting. Within 30 days, establish monitoring of the fastify and fast-uri GitHub repositories for patch releases, and prepare an expedited testing and deployment process for when a vendor fix becomes available.

fast-uri CVE-2026-75975

EUVD-2026-64772 HIGH

Improper Input Validation (CWE-20)

2026-08-24 ce714d77-add3-4f53-aff5-83d477b104bb

GHSA-f65p-4m7j-42xc

SSRF Node.js Red Hat Suse Fast Uri Openjsf

7.5

CVSS 3.1 · Vendor: ce714d77-add3-4f53-aff5-83d477b104bb

Severity by source

Vendor (ce714d77-add3-4f53-aff5-83d477b104bb) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

Network vector, no privileges or interaction required; C:L added over vendor score because SSRF enables partial internal service response access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).

CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 24, 2026 - 11:01 EUVD

Analysis Generated

Aug 24, 2026 - 10:31 vuln.today

CVE Published

Aug 24, 2026 - 10:16 cve.org

HIGH 7.5

DescriptionCVE.org

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.

Articles & Coverage 1

News 5 New Node.js Vulnerabilities - 5 High Severity, No Public POC Aug 25, 2026

AnalysisAI

Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify ecosystem, allows remote unauthenticated attackers to redirect outbound requests from a target application to local or private IPv6 addresses by submitting crafted bracketed IPv6 literals with invalid trailing characters. The custom IPv6 parser silently normalizes malformed literals - collapsing some to the unspecified address (loopback) and others to private-range addresses - and returns no error on the parsed result, defeating any application-level error checking. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no special privileges and low complexity, making automated exploitation plausible against any exposed application that normalizes untrusted URLs through an affected fast-uri version.

Technical ContextAI

fast-uri is a standalone URI parsing library for Node.js (npm: fast-uri), primarily maintained within the fastify organization and consumed by the fastify HTTP framework and its plugin ecosystem. The vulnerability resides in the library's custom bracketed IPv6 literal parser (authority component), which implements only a subset of the IPv6 grammar defined in RFC 3986. When a bracketed literal contains trailing characters that are invalid per the RFC - for example '[::1]invalid' - the parser truncates the garbage rather than raising a parse error. The root cause is CWE-20 (Improper Input Validation): the parser does not validate that the bracketed IP literal conforms to the full grammar before accepting it. The consequences are twofold: first, a trust boundary is violated because an application checking the 'error' field of the parsed object cannot detect the rewrite; second, the normalized (attacker-chosen) IPv6 address is then handed to a Node.js HTTP client, which resolves and connects to whatever destination the normalization produces - typically loopback (::) or private-range addresses. Affected CPE spans three minor release trains: fast-uri 2.3.1-2.4.4, 3.0.0-3.1.5, and 4.0.0-4.1.2.

RemediationAI

Upgrade fast-uri to a patched release: 2.4.5 (for the 2.x train), 3.1.6 (for the 3.x train), or 4.1.3 (for the 4.x train). These releases validate bracketed IP literals against the full RFC 3986 grammar and mark malformed literals as authority errors, restoring detectability via the error field. See the vendor security advisory at https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc for patch details. If immediate upgrade is not feasible, a specific compensating control is to validate all attacker-controlled IPv6 literals against an RFC-compliant pattern before passing them to fast-uri - note that this must happen upstream of the library call, since the library itself does not surface the error. A second control is to apply an outbound network policy at the OS or container level that blocks connections to loopback (::1, ::) and private-range IPv6 addresses (fc00::/7, fe80::/10), which prevents the most common SSRF targets; this has the trade-off of also blocking legitimate internal-service calls if the application intentionally routes to those ranges. Do not rely on checking the parsed result's error field as a mitigation for unpatched versions, as the vulnerability specifically bypasses this check.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique SSRF

View all

CVE-2021-34473 CRITICAL POC

9.1

CVE-2021-26855 CRITICAL POC

9.1

CVE-2021-21985 CRITICAL POC

9.8

CVE-2024-21893 HIGH POC

8.2

CVE-2021-40438 CRITICAL POC

9.0

CVE-2021-22054 HIGH POC

7.5

CVE-2021-21975 HIGH POC

7.5

CVE-2016-3718 MEDIUM POC

5.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.4	Not-Affected

CVE-2026-75975 vulnerability details – vuln.today

Back

fast-uri CVE-2026-75975

Severity by source

CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-20 – Improper Input Validation

Same technique SSRF

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code