EUVD-2026-64773Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SSRF via this flaw exposes internal services and headers, warranting C:L rather than C:N; all other metrics match the network-accessible, no-auth, no-interaction exploitation path described.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.
Articles & Coverage 1
AnalysisAI
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application accepts untrusted URI input and passes it to an affected fast-uri version (2.3.1-2.4.4, 3.0.0-3.1.5, or 4.0.0-4.1.2) for parsing, and then either (a) uses the normalized or resolved URI output from fast-uri to make an outbound network request, or (b) performs an access-control decision using the parsed host value from fast-uri against the original input. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately captures the low-friction attack surface - no authentication, no special configuration, and fully network-accessible - but likely understates total impact by assigning C:N; SSRF attacks enabled by this flaw can expose internal metadata endpoints, service credentials in headers, and internal network topology, suggesting real-world confidentiality risk beyond what the base score reflects. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a URI such as 'htt%70%3A%2F%2Fattacker.example.com/steal' to a Fastify application that uses fast-uri to parse incoming redirect targets and checks the parsed host against an allowlist before forwarding. The library decodes the scheme, finds no recognizable authority, returns host as undefined - the allowlist check passes. … |
| Remediation | Upgrade fast-uri to version 2.4.5, 3.1.6, or 4.1.3 for the respective major version branch in use; all three releases fix the issue by rejecting schemes that are not valid after decoding, as confirmed by the vendor advisory at https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp and the OpenJS CNA listing at https://cna.openjsf.org/security-advisories.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Node.js services and applications using Fastify, documenting fast-uri versions in current deployment; prioritize production systems and publicly-accessible services for risk assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Share
External POC / Exploit Code
Leaving vuln.today