CVE-2026-75975: fast-uri Node.js SSRF Vulnerability

CVE-2026-75975 Overview

CVE-2026-75975 is an input validation flaw in fast-uri, a URI parser for Node.js maintained under the Fastify project. The custom parser for bracketed IPv6 literals fails to validate the complete IPv6 grammar. Invalid trailing text in an authority is silently discarded, and a malformed attacker-controlled host is rewritten to a different valid IPv6 destination. Applications that normalize untrusted URLs before outbound requests, redirects, proxy routing, or address-policy checks can be redirected to loopback or private-range targets. The result is a server-side request forgery (SSRF) and address-policy bypass primitive.

Critical Impact
Malformed IPv6 literals collapse to :: or private-range addresses without an error being set, enabling SSRF against local and internal services when applications trust fast-uri output for policy enforcement.

Affected Products

fast-uri versions 2.3.1 up to but not including 2.4.5
fast-uri versions 3.0.0 up to but not including 3.1.6
fast-uri versions 4.0.0 up to but not including 4.1.3

Discovery Timeline

2026-08-24 - CVE-2026-75975 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-75975

Vulnerability Analysis

The flaw is classified as improper input validation [CWE-20]. fast-uri implements a custom parser for URI authorities, including bracketed IPv6 literals of the form [<address>]. When parsing these literals, the parser accepts the leading portion that resembles a valid IPv6 address and discards any invalid trailing characters inside the brackets. It does not raise a parse error on the returned object.

Downstream consumers rely on two guarantees: that the host field faithfully represents the input authority, and that malformed inputs surface through the error field. Both assumptions fail here. A URL such as http://[::junk]/ is normalized to the unspecified address ::, which most Node HTTP clients resolve to loopback (127.0.0.1 or ::1) on outbound connection. Other malformed literals collapse to private-range IPv6 addresses.

Root Cause

The root cause is an incomplete IPv6 grammar check inside the bracketed-literal branch of the parser. The routine matches the address prefix greedily and terminates at the closing bracket without asserting that the entire content matches RFC 3986 IP-literal rules. Trailing garbage is dropped rather than treated as an authority error.

Attack Vector

An attacker supplies a crafted URL to any application feature that parses, normalizes, or validates URLs with fast-uri before issuing an outbound request or making a routing decision. Common sinks include webhook receivers, image or metadata fetchers, SSRF filters that inspect the parsed host, redirect validators, and proxy or gateway route selectors. Because the parser reports no error, allow-list logic that checks the parsed host against a denylist of loopback and private ranges is bypassed. The attack requires no authentication or user interaction and is exploitable across the network. The parsed URL is then handed to an HTTP client that connects to the rewritten IPv6 target, reaching internal services such as cloud metadata endpoints, admin interfaces, or unauthenticated management APIs.

No public proof-of-concept exploit code is available at the time of publication. See the GitHub Security Advisory GHSA-f65p-4m7j-42xc for advisory details.

Detection Methods for CVE-2026-75975

Indicators of Compromise

Outbound HTTP or HTTPS connections from application servers to IPv6 loopback (::1), the unspecified address (::), or IPv6 unique local addresses (fc00::/7) originating from URL-fetching code paths.
Application logs showing user-supplied URLs containing bracketed IPv6 literals with unexpected trailing characters inside the brackets.
Requests to internal-only IPv6 endpoints from workloads that should only egress to public destinations.

Detection Strategies

Inventory Node.js applications and dependencies for fast-uri using npm ls fast-uri or Software Bill of Materials tooling, and flag versions in the vulnerable ranges.
Add pre-flight validation that rejects any bracketed IPv6 authority whose content does not fully match the IPv6 grammar, independent of the URL parser in use.
Instrument outbound HTTP clients to log the final resolved destination address alongside the original input URL for correlation.

Monitoring Recommendations

Alert on outbound connections from application tiers to loopback and RFC 4193 unique local IPv6 ranges.
Monitor for cloud metadata service access (fd00:ec2::254, 169.254.169.254) originating from URL-fetch subsystems.
Track dependency updates in CI to ensure fast-uri upgrades are propagated across transitive dependencies of Fastify and related packages.

How to Mitigate CVE-2026-75975

Immediate Actions Required

Upgrade fast-uri to 2.4.5, 3.1.6, or 4.1.3 depending on the major version in use.
Audit direct and transitive dependencies with npm audit and npm ls fast-uri to identify all installations, including nested versions pulled in by Fastify plugins and AJV formats.
Enforce host allow-lists based on resolved IP addresses, not on parsed URL fields, before issuing outbound requests to untrusted destinations.

Patch Information

The issue is fixed in fast-uri versions 2.4.5, 3.1.6, and 4.1.3. The patched releases validate bracketed IP literals against the full IPv6 grammar and mark malformed literals as authority errors, so consumers checking the error field will detect the rewrite. Refer to the GitHub Security Advisory GHSA-f65p-4m7j-42xc and the OpenJS Foundation Security Advisories for release details.

Workarounds

Reject any input URL whose authority contains a [ character followed by content that does not fully match RFC 3986 IP-literal grammar, before passing it to fast-uri.
Resolve the target hostname to an IP address and enforce SSRF policy on the resolved address, blocking loopback, link-local, and private ranges for both IPv4 and IPv6.
Restrict egress from application workloads at the network layer so that outbound traffic to internal IPv6 ranges is denied by default.

bash

# Configuration example
npm install fast-uri@^4.1.3
npm ls fast-uri