CVE-2026-75899: Double-Decoding Host Bypass and SSRF in fast-uri
Vulnerability ID: CVE-2026-75899
CVSS Score: 7.5
Published: 2026-09-02
A double-decoding vulnerability in the fast-uri package allows unauthenticated remote attackers to bypass host-policy validation and conduct Server-Side Request Forgery (SSRF) attacks by submitting nested percent-encoded URI strings.
TL;DR
The fast-uri package redundantly decodes host components twice across the parsing and recomposition lifecycle. Attackers can leverage nested percent-encoded host strings to bypass security boundary checks, leading to unauthenticated SSRF to internal network nodes and cloud metadata endpoints.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-174 / CWE-918
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 7.5 (High)
- EPSS Score: 0.00234
- Impact Type: Integrity (SSRF / Host Bypass)
- Exploit Status: poc
- CISA KEV Status: Not Listed
Affected Systems
- Node.js applications running fast-uri dependency packages < 2.4.5
- Node.js applications running fast-uri dependency packages >= 3.1.2 and < 3.1.6
- Node.js applications running fast-uri dependency packages >= 4.0.0 and < 4.1.3
-
fast-uri: >= 2.4.1 < 2.4.5 (Fixed in:
2.4.5) -
fast-uri: >= 3.1.2 < 3.1.6 (Fixed in:
3.1.6) -
fast-uri: >= 4.0.0 < 4.1.3 (Fixed in:
4.1.3)
Code Analysis
Commit: 2642290
v2.4.5 Fix Commit (Merge commit from fork)
Commit: 8c15dbe
v3.1.6 Fix Commit (Merge commit from fork)
Commit: ae92a4c
v4.1.3 Fix Commit (Merge commit from fork)
Commit: 4e99790
v4.1.3 Release Bump Commit
Exploit Details
- GitHub Security Advisory Tests: Official test specifications verifying parsing and recomposition failures on double-encoded hosts
Mitigation Strategies
- Upgrade the fast-uri package to patched versions 2.4.5, 3.1.6, or 4.1.3 depending on the respective dependency branch
- Implement deep input validation to reject hostnames containing raw percent signs (%) prior to passing them to parsing and recomposition routines
- Verify transitive dependencies (such as fastify and related plugins) to confirm no older versions of fast-uri are pulled into the project lockfile
Remediation Steps:
- Identify the current installed version of fast-uri by inspecting package-lock.json or yarn.lock
- Run the upgrade command: npm install fast-uri@4.1.3 (or @3.1.6 / @2.4.5 depending on your major version pin)
- Re-generate package lockfiles and run npm audit to confirm the security advisory is resolved
- Deploy the updated application to staging environments and execute validation test scripts containing nested percent-encoded vectors to ensure functionality remains normal
References
- GitHub Security Advisory (GHSA-fph4-wmhf-6fwf)
- OpenJS Foundation Security Advisories
- NVD Vulnerability Details - CVE-2026-75899
Read the full report for CVE-2026-75899 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)