DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-75931: CVE-2026-75931: Host Confusion and SSRF Bypass via Scheme-Relative URIs in fast-uri

#security #cve #cybersecurity

CVE-2026-75931: Host Confusion and SSRF Bypass via Scheme-Relative URIs in fast-uri

Vulnerability ID: CVE-2026-75931
CVSS Score: 7.5
Published: 2026-09-02

A host confusion vulnerability exists in the fast-uri Node.js library when parsing scheme-relative URI references. Due to inconsistent domain name canonicalization, applications validating resolved hosts can be bypassed by downstream WHATWG-compliant parsers, facilitating Server-Side Request Forgery (SSRF).

TL;DR

A discrepancy in host canonicalization within fast-uri allows bypasses of SSRF and access-control filters when handling scheme-relative URI references.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-436 (Interpretation Conflict)
  • Attack Vector: Network (AV:N)
  • CVSS Score: 7.5 (High)
  • EPSS Score: 0.00247 (15.89th percentile)
  • Impact: SSRF Filter Bypass / Host Obfuscation
  • Exploit Status: PoC / Conceptual
  • CISA KEV Status: Not Listed

Affected Systems

  • fast-uri (Node.js NPM package)
  • fast-uri: >= 2.4.2, < 2.4.5 (Fixed in: 2.4.5)
  • fast-uri: >= 3.1.3, < 3.1.6 (Fixed in: 3.1.6)
  • fast-uri: >= 4.0.1, < 4.1.3 (Fixed in: 4.1.3)

Code Analysis

Commit: 4e4ebd8

Ensure resolve canonicalises the host using the final resolved scheme and throw when it fails

Commit: 0256bc8

Backport resolution canonicalisation fixes to legacy 2.4.x branch

Commit: 444ecda

Additional canonicalisation checks and handling of URL hostname conversion errors

Mitigation Strategies

  • Upgrade fast-uri to safe versions (2.4.5, 3.1.6, or 4.1.3)
  • Use native WHATWG URL parser to validate hostnames in security gateways
  • Force package resolutions/overrides for transitive fast-uri dependencies

Remediation Steps:

  1. Identify and audit fast-uri versions inside node_modules and package lockfiles
  2. Run npm update fast-uri or yarn upgrade fast-uri to download fixed releases
  3. Implement package overrides or resolutions in package.json to pin secure versions
  4. Add WHATWG URL validation on policy enforcement checks as a defense-in-depth measure

References

Read the full report for CVE-2026-75931 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)