CVE-2026-75899: fast-uri Node.js SSRF Vulnerability

CVE-2026-75899 Overview

CVE-2026-75899 is a URI parsing flaw in fast-uri, a URI parser library for Node.js maintained under the Fastify project. The library decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition. A single call to normalize or resolve can turn nested percent-encoded input into a different network destination, such as a loopback hostname or address. The behavior contradicts RFC 3986 section 2.4, which requires implementations not to decode the same string more than once. The issue is an incomplete-fix variant of CVE-2026-6322 [CWE-174].

Critical Impact
Applications that normalize or resolve untrusted URIs before outbound routing, redirect validation, or host allow-list checks can be redirected to attacker-chosen destinations, enabling server-side request forgery (SSRF) and host-policy bypass.

Affected Products

fast-uri versions 2.4.1 up to but not including 2.4.5
fast-uri versions 3.1.2 up to but not including 3.1.6
fast-uri versions 4.0.0 up to but not including 4.1.3

Discovery Timeline

2026-08-24 - CVE-2026-75899 published to the National Vulnerability Database (NVD)
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-75899

Vulnerability Analysis

The vulnerability stems from repeated percent-decoding [CWE-174] within fast-uri during URI processing. When the library parses a URI, it decodes percent-escaped characters in the hostname component. During authority recomposition, the already-decoded hostname is decoded again. A URI whose hostname is doubly percent-encoded to spell out a sensitive destination survives the first decoding as opaque text and resolves to the sensitive destination after the second decoding.

Applications commonly call normalize or resolve on untrusted URIs before enforcing host allow-lists, blocking loopback destinations, or routing outbound HTTP requests. Because the recomposed authority differs from the authority present after initial parsing, security checks executed on one representation do not reflect the destination used at request time. Attackers can craft URIs that pass allow-list validation while producing internal targets such as 127.0.0.1, localhost, or metadata service hostnames.

Root Cause

The root cause is a violation of RFC 3986 section 2.4, which mandates that a percent-encoded octet be decoded exactly once. fast-uri performed decoding both during parsing and during authority recomposition. The fix normalizes percent escapes once and preserves encoded percent signs across recomposition. This is an incomplete-fix variant of CVE-2026-6322.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker supplies a URI containing a doubly percent-encoded hostname to any application endpoint that ingests external URIs and invokes fast-uri for normalization or resolution. Typical exploitation scenarios include webhook receivers, redirect validators, image proxies, SSRF-hardened HTTP clients, and OAuth redirect_uri handlers. Refer to the GitHub Security Advisory GHSA-fph4-wmhf-6fwf for technical details.

No verified proof-of-concept code is published in the enriched advisory data. The vulnerability manifests through crafted URIs rather than compiled exploits; see the security advisory for representative encoded inputs.

Detection Methods for CVE-2026-75899

Indicators of Compromise

Outbound HTTP requests from application servers to loopback addresses (127.0.0.0/8, ::1), link-local addresses, or cloud metadata endpoints (169.254.169.254) originating from URI-handling code paths.
Application logs showing successful URI validation followed by requests to internal hostnames not present in the original submitted URI.
Inbound HTTP payloads containing doubly percent-encoded sequences such as %25%36%31 in URI fields, especially in webhook, callback, or redirect parameters.

Detection Strategies

Inventory Node.js applications and identify direct or transitive dependencies on fast-uri versions 2.4.1–2.4.4, 3.1.2–3.1.5, and 4.0.0–4.1.2 using npm ls fast-uri or software composition analysis tooling.
Instrument URI validation code paths to log both the parsed authority and the final recomposed authority, and alert on mismatches.
Correlate outbound HTTP requests from application tiers against submitted URI parameters to detect authority substitution.

Monitoring Recommendations

Enable egress filtering and alert on application-tier connections to RFC1918, loopback, and cloud metadata IP ranges.
Ingest application and reverse-proxy logs into a centralized analytics platform to correlate suspicious encoded URI patterns with downstream outbound traffic.
Track dependency version drift across build artifacts to identify environments still running vulnerable fast-uri releases.

How to Mitigate CVE-2026-75899

Immediate Actions Required

Upgrade fast-uri to version 2.4.5, 3.1.6, or 4.1.3 depending on the major version in use.
Rebuild and redeploy Node.js applications and container images that bundle vulnerable versions as transitive dependencies.
Audit any code paths that call normalize or resolve on untrusted URIs before allow-list checks or outbound requests.

Patch Information

The maintainers fixed the issue in fast-uri2.4.5, 3.1.6, and 4.1.3. The patched releases normalize percent escapes once and preserve encoded percent signs, aligning with RFC 3986 section 2.4. See the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-fph4-wmhf-6fwf for release notes and commit references.

Workarounds

Apply strict egress network policies that block application servers from reaching loopback, link-local, and cloud metadata addresses regardless of URI parsing outcomes.
Perform host allow-list validation against the final recomposed authority immediately before issuing the outbound request, not against the parsed URI object.
Reject inbound URI parameters that contain percent-encoded percent signs (%25) in the authority component when the business logic does not require them.

bash

# Configuration example - upgrade to patched versions
npm install fast-uri@^4.1.3
# or for the 3.x branch
npm install fast-uri@^3.1.6
# or for the 2.x branch
npm install fast-uri@^2.4.5

# Verify installed version across the dependency tree
npm ls fast-uri