Skip to main content

fast-uri EUVDEUVD-2026-64763

| CVE-2026-75899 HIGH
Double Decoding of the Same Data (CWE-174)
2026-08-24 openjs GHSA-fph4-wmhf-6fwf
SSRF Node.js Red Hat Suse Fast Uri
7.5
CVSS 3.1 · Vendor: openjs
Share

Severity by source

Vendor (openjs) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vuln.today AI
8.2 HIGH

Network-reachable, no auth needed, low complexity; added C:L because SSRF inherently enables reading responses from internal services beyond the integrity bypass.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

3
Analysis Generated
Aug 24, 2026 - 10:23 vuln.today
Patch available
Aug 24, 2026 - 10:02 EUVD
CVE Published
Aug 24, 2026 - 09:40 cve.org
HIGH 7.5

DescriptionCVE.org

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.

Articles & Coverage 2

News 5 New Node.js Vulnerabilities - 5 High Severity, No Public POC Aug 25, 2026 News 3 New Node.js Vulnerabilities - 3 High Severity Aug 24, 2026

AnalysisAI

Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

fast-uri is a Node.js library, distributed under the fastify organization, that provides RFC 3986-compliant URI parsing and manipulation. CWE-174 (Double Decoding) is the root cause: the library applies percent-decode logic in two separate code paths - first when tokenizing the authority component during initial parse, and again when recomposing the authority string for normalization or resolution output. RFC 3986 §2.4 explicitly prohibits decoding the same encoded sequence more than once. The affected CPE is cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:*. The CVSS vector AV:N/AC:L/PR:N/UI:N reflects that any network-reachable application accepting untrusted URIs and passing them through fast-uri is exposed without authentication or special interaction. The variant relationship to CVE-2026-6322 indicates the original patch was incomplete - it corrected one decode site but left the second active.

RemediationAI

Upgrade fast-uri to the vendor-released patched versions: 2.4.5, 3.1.6, or 4.1.3, which normalize percent escapes exactly once and preserve encoded percent signs to prevent re-decoding. The advisory is available at https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf and the OpenJS CNA advisory index at https://cna.openjsf.org/security-advisories.html. For applications that cannot immediately upgrade, a compensating control is to reject or canonicalize inbound URIs before passing them to fast-uri - specifically, detect and refuse any URI where a hostname component contains a literal percent sign following another percent sign (the signature of double encoding), noting that this filter may reject some legitimate URIs and should be tested for side effects. Do not rely on application-layer SSRF block-lists alone as a mitigation, as the library's double-decode happens before any downstream policy check.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-174 – Double Decoding of the Same Data

View all
CVE-2026-93903 CRITICAL
9.4
CVE-2026-92839 MEDIUM
4.3

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected

Share

EUVD-2026-64763 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy