DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-75975: CVE-2026-75975: Server-Side Request Forgery (SSRF) and Address-Policy Bypass via Malformed IPv6 Parser in fast-uri

#security #cve #cybersecurity

CVE-2026-75975: Server-Side Request Forgery (SSRF) and Address-Policy Bypass via Malformed IPv6 Parser in fast-uri

Vulnerability ID: CVE-2026-75975
CVSS Score: 7.5
Published: 2026-09-02

A critical parser differential vulnerability in the Node.js fast-uri library allows unauthenticated remote attackers to bypass address-validation filters and perform Server-Side Request Forgery (SSRF). The library fails to validate complete IPv6 grammar inside bracketed literals, silently truncating invalid trailing characters and normalising malformed hosts into valid loopback or private addresses.

TL;DR

The fast-uri library's IPv6 parser silently normalises invalid IP literals like [::not-valid] to ::. Attackers exploit this parser differential to bypass security blocklists, redirecting outbound HTTP requests to internal networks or local services.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-20, CWE-918
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 7.5 (High)
  • Exploit Maturity: Proof of Concept (PoC)
  • CISA KEV Status: Not Listed
  • Impact: Integrity (High), Server-Side Request Forgery (SSRF)

Affected Systems

  • fast-uri (v2.3.1 - v2.4.4)
  • fast-uri (v3.0.0 - v3.1.5)
  • fast-uri (v4.0.0 - v4.1.2)
  • fast-uri: >= 2.3.1, < 2.4.5 (Fixed in: 2.4.5)
  • fast-uri: >= 3.0.0, < 3.1.6 (Fixed in: 3.1.6)
  • fast-uri: >= 4.0.0, < 4.1.3 (Fixed in: 4.1.3)

Code Analysis

Commit: 3728465

Main fix for malformed IPv6 parsing in fast-uri v4 branch

Commit: 607bfbe

Backport fix to v3 branch

Commit: 9161ede

Backport fix to v2 branch

Mitigation Strategies

  • Upgrade the fast-uri dependency to patched versions: 2.4.5, 3.1.6, or 4.1.3.
  • Implement regex validation on the input URL to reject any bracketed hosts containing non-hexadecimal or non-colon characters.
  • Utilize package resolution overrides to force transitive dependencies to use the fixed versions.

Remediation Steps:

  1. Step 1: Check your package lockfile for references to fast-uri.
  2. Step 2: Run 'npm install fast-uri@latest' or force the dependency update in package.json using overrides.
  3. Step 3: Ensure that any parsing logic verifies the '.error' field of the output returned by the parse function.
  4. Step 4: Redeploy the application and monitor egress HTTP requests for loopback resolution patterns.

References

Read the full report for CVE-2026-75975 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)