Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75899— fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Quick assessment

Affected
fast-uri fast-uri
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fast-uri 是用于 Node.js 的 URI 解析库。它在解析过程中会对主机名中的百分号转义序列进行一次解码，随后在重新组合授权部分（authority）时再次对该主机名进行解码。因此，单次调用 normalize（规范化）或 resolve（解析）函数，就可能将经过嵌套百分号编码的输入转换为不同的网络目标地址，例如回环主机名或回环地址。 例如，一个经过双重编码的主机名（其原始内容表示回环名称）在单次操作中即可被解码为该实际的主机名，这违背了 RFC 3986 第 2.4 节的规定：实现不得对同一字符串进行

CVSS 7.5 · High EPSS 0.23% · P14

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 6

VendorProduct Version RangeStatus
fast-uri fast-uri 2.4.1< 2.4.5 affected
2.4.5 unaffected
3.1.2< 3.1.6 affected
3.1.6 unaffected
4.0.0< 4.1.3 affected
4.1.3 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75899

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Source: CVE Program / CVE List V5
Vulnerability Description
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对同一数据的双重编码
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fast-uri fast-uri 2.4.1 ~ 2.4.5 -

II. Public POCs for CVE-2026-75899

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9500 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-75899

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75899 (1)

Same Patch Batch · fast-uri · 2026-08-24 · 4 CVEs total

CVE-2026-75931 7.5 HIGH fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative
CVE-2026-75975 7.5 HIGH fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
CVE-2026-76172 7.5 HIGH fast-uri vulnerable to host confusion via percent-encoded scheme normalization

IV. Related Vulnerabilities

Same product: fast-uri
Same vendor: fast-uri

V. Comments for CVE-2026-75899

No comments yet

Leave a comment