DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-76172: CVE-2026-76172: Parser Differential and Host Confusion in fast-uri

#security #cve #cybersecurity

CVE-2026-76172: Parser Differential and Host Confusion in fast-uri

Vulnerability ID: CVE-2026-76172
CVSS Score: 7.5
Published: 2026-09-02

A critical parser differential and host confusion vulnerability (CVE-2026-76172) exists in fast-uri, a dependency-free URI validation and normalization library for Node.js. This vulnerability stems from improper validation of the URI scheme component after decoding percent-encoded characters using the legacy global unescape() function. This allows structural characters such as path delimiters and control characters to be written raw into the output stream during serialization, causing host confusion, Server-Side Request Forgery (SSRF), or HTTP response splitting downstream.

TL;DR

fast-uri parses percent-encoded schemes with lenient decoding and no validation, resulting in structure mutation, host confusion, and SSRF upon serialization.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-177
  • Attack Vector: Network (Unauthenticated)
  • CVSS Score: 7.5
  • EPSS Score: 0.00247 (Percentile: 15.89%)
  • Impact: Host Confusion / SSRF / HTTP Response Splitting
  • Exploit Status: Proof-of-Concept (PoC)
  • KEV Status: Not Listed

Affected Systems

  • fast-uri NPM package (versions 2.3.1 to 2.4.4, 3.0.0 to 3.1.5, and 4.0.0 to 4.1.2)
  • Fastify-dependent security gateways and reverse proxies utilizing fast-uri for input resolution and routing validation
  • fast-uri: >= 2.3.1 < 2.4.5 (Fixed in: 2.4.5)
  • fast-uri: >= 3.0.0 < 3.1.6 (Fixed in: 3.1.6)
  • fast-uri: >= 4.0.0 < 4.1.3 (Fixed in: 4.1.3)

Code Analysis

Commit: c6a74bf

Strict validation of URI schemes during parsing and serialization

Commit: a941e62

Backport scheme validation patch to v3.x release line

Mitigation Strategies

  • Upgrade fast-uri dependency to patched versions immediately.
  • Sanitize input URIs to reject percent-encoded sequences in the scheme component before parsing.
  • Align parser implementations across upstream validation layers and downstream HTTP clients to eliminate parser differentials.

Remediation Steps:

  1. Audit the project dependency tree to locate instances of fast-uri using 'npm ls fast-uri' or 'yarn why fast-uri'.
  2. Execute the update command 'npm update fast-uri' or forcefully resolve fast-uri to safe versions.
  3. Verify that the lockfile reflects versions 2.4.5, 3.1.6, 4.1.3, or higher.
  4. Implement a central input validation regex for all user-controlled URLs to ensure the scheme strictly contains allowed alphanumeric characters prior to processing.

References

Read the full report for CVE-2026-76172 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)