What is the CVSS score of CVE-2026-76172?

CVE-2026-76172 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of fast-uri are affected by CVE-2026-76172?

The fast-uri library, core to the Fastify framework, contains a URI parsing flaw (CVE-2026-76172) allowing unauthenticated remote attackers to bypass URI validation controls, enabling server-side…. A patch is available.

Is there a public PoC exploit available for CVE-2026-76172?

Yes, a public proof-of-concept exploit is available for CVE-2026-76172. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-76172?

Within 24 hours, inventory all Node.js services and applications using Fastify, documenting fast-uri versions in current deployment; prioritize production systems and publicly-accessible services for risk assessment. Within 7 days, implement interim compensating controls including network segmentation for affected services, WAF rules to block percent-encoded slashes in URI scheme components, enhanced logging of URI parsing failures, and authentication-based restrictions on SSRF-prone features such as webhooks and external API integrations. Within 30 days, prepare and execute a comprehensive Fastify framework update to apply the vendor patch once released, including pre-production validation; establish ongoing monitoring for unusual URI patterns and maintain direct communication with the Fastify maintainers regarding patch timelines.

fast-uri CVE-2026-76172

EUVD-2026-64773 HIGH

Improper Handling of URL Encoding (Hex Encoding) (CWE-177)

2026-08-24 openjs

GHSA-jqff-g426-hqxp

SSRF Node.js Red Hat Suse Fast Uri

7.5

CVSS 3.1 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

SSRF via this flaw exposes internal services and headers, warranting C:L rather than C:N; all other metrics match the network-accessible, no-auth, no-interaction exploitation path described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 24, 2026 - 11:01 EUVD

Analysis Generated

Aug 24, 2026 - 10:51 vuln.today

CVE Published

Aug 24, 2026 - 10:07 cve.org

HIGH 7.5

DescriptionCVE.org

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.

Articles & Coverage 1

News 5 New Node.js Vulnerabilities - 5 High Severity, No Public POC Aug 25, 2026

AnalysisAI

Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.

Technical ContextAI

fast-uri implements RFC 3986 URI parsing for Node.js and is a foundational dependency of the Fastify web framework. The root cause is CWE-177 (Improper Handling of URL Encoding): a legacy decoding pass is applied to the scheme component during parsing but is never reversed before serialization. RFC 3986 explicitly prohibits percent-encoding in the scheme; when fast-uri encounters '%2F' (encoded slash) in the scheme, it decodes it, which eliminates the apparent authority delimiter, leaving the parsed host undefined. However, serialization and normalization write the decoded scheme back verbatim, reintroducing the slashes as a '//' authority delimiter with whatever follows as the host - which is fully attacker-controlled. A secondary vector exists because the legacy decoder also expands non-standard escape sequences, allowing bypass of upstream input filters that strip standard encodings. Additionally, control characters such as CR ('%0D') and LF ('%0A') placed in the scheme survive into output as raw bytes, enabling HTTP response splitting or header injection in contexts where the URI is written to outbound HTTP headers. The affected CPE is cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:* across the 2.x, 3.x, and 4.x branches.

RemediationAI

Upgrade fast-uri to version 2.4.5, 3.1.6, or 4.1.3 for the respective major version branch in use; all three releases fix the issue by rejecting schemes that are not valid after decoding, as confirmed by the vendor advisory at https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp and the OpenJS CNA listing at https://cna.openjsf.org/security-advisories.html. Running 'npm audit' or 'npm update fast-uri' in the project directory will identify and apply the fix where npm can resolve it automatically. If immediate upgrading is blocked, a compensating control is to validate all URI inputs at the application boundary by rejecting any input whose scheme portion contains percent-encoded characters (i.e., reject strings matching /^[^:]*%[0-9a-fA-F]{2}.*:/) before passing to fast-uri; this pre-filter adds latency and must be maintained as a custom layer, and it does not address the CRLF secondary vector. Additionally, disabling or sandboxing any normalization or resolution logic that consumes fast-uri output, and ensuring outbound HTTP clients do not write raw fast-uri output into request headers without sanitization, reduces exposure to both SSRF and CRLF injection vectors until the patch is applied.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-177 – Improper Handling of URL Encoding (Hex Encoding)

View all

CVE-2026-76504 CRITICAL POC

9.8

CVE-2022-27780 HIGH POC

7.5

CVE-2018-3718 MEDIUM POC

5.3

CVE-2026-22037 HIGH

8.4

CVE-2026-22031 HIGH

8.4

CVE-2026-96748 HIGH POC

8.3

CVE-2026-15371 HIGH

8.1

CVE-2026-29045 HIGH

7.5

Same technique SSRF

View all

CVE-2021-34473 CRITICAL POC

9.1

CVE-2021-26855 CRITICAL POC

9.1

CVE-2021-21985 CRITICAL POC

9.8

CVE-2024-21893 HIGH POC

8.2

CVE-2021-40438 CRITICAL POC

9.0

CVE-2021-22054 HIGH POC

7.5

CVE-2021-21975 HIGH POC

7.5

CVE-2016-3718 MEDIUM POC

5.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.4	Not-Affected

CVE-2026-76172 vulnerability details – vuln.today

Back

fast-uri CVE-2026-76172

Severity by source

CVSS VectorVendor: openjs

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-177 – Improper Handling of URL Encoding (Hex Encoding)

Same technique SSRF

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code