CVE-2026-76172: fast-uri Node.js SSRF Vulnerability

CVE-2026-76172 Overview

CVE-2026-76172 is a URI parser confusion vulnerability in fast-uri, a URI parsing library for Node.js maintained under the Fastify project. The flaw allows attackers to craft URIs whose scheme contains percent-encoded slashes, causing the parser and serializer to disagree about the authority component. Applications relying on the parsed host for allowlist checks receive undefined, while resolution or normalization of the same input yields an attacker-controlled host. The result is off-site redirects, server-side request forgery (SSRF), and address-policy bypasses [CWE-177].

Critical Impact
A single crafted URI can bypass host allowlists, enable SSRF against internal services, and inject raw carriage return and line feed characters into downstream output.

Affected Products

fast-uri versions 2.3.1 up to but not including 2.4.5
fast-uri versions 3.0.0 up to but not including 3.1.6
fast-uri versions 4.0.0 up to but not including 4.1.3

Discovery Timeline

2026-08-24 - CVE-2026-76172 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-76172

Vulnerability Analysis

The vulnerability stems from asymmetric handling of the scheme component during URI parsing and serialization. fast-uri runs a legacy decoding pass over the scheme and never re-escapes the result. The host component, by contrast, is re-escaped on output. When an input scheme contains percent-encoded slashes, the parser treats the URI as having no authority. Both the parsed host and any parse error are returned as undefined.

Serialization then writes the scheme back out verbatim. Resolving or normalizing the same input produces a network-path reference whose authority is chosen by the attacker. The output re-parses to that attacker-controlled host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base URL, receives the opposite of what it validated.

The legacy decoder also expands non-standard escape forms. This widens the attack surface beyond upstream filters that only normalize standard percent-encoding. Control characters in the scheme reach the output as raw carriage return and line feed, enabling response splitting and header injection in HTTP contexts.

Root Cause

The root cause is [CWE-177: Improper Handling of URL Encoding (Hex Encoding)]. The scheme parser decodes but does not validate or re-encode. Serialization trusts the stored scheme without checking whether it still conforms to the ABNF for a valid scheme. This mismatch between parse-time and serialize-time semantics creates a parser differential.

Attack Vector

An attacker supplies a URI with a scheme containing encoded slashes such as http%2F%2Fevil.example.com/path. The application parses the URI, checks the resulting host field against an allowlist, and sees undefined. The application either treats this as a same-origin relative reference or proceeds to resolve the URI against a trusted base. Resolution emits a URI pointing at evil.example.com. Subsequent HTTP clients, redirect handlers, or SSRF-sensitive code paths then contact the attacker-controlled host. Non-standard escape sequences and embedded CR/LF characters further extend the impact.

See the GitHub Security Advisory GHSA-jqff-g426-hqxp for advisory details.

Detection Methods for CVE-2026-76172

Indicators of Compromise

Outbound HTTP requests from application servers to unexpected external hosts following user-supplied URL input
Log entries containing URIs with percent-encoded scheme separators such as %2F, %2f, or non-standard escape forms
HTTP response headers containing unexpected CRLF sequences originating from user-controlled URI inputs
Redirect responses (3xx) pointing to hosts outside the application's declared allowlist

Detection Strategies

Inventory Node.js projects for fast-uri in package-lock.json and yarn.lock files across the affected version ranges
Instrument URI parsing paths to log inputs where parsed.host is undefined but parsed.scheme is non-empty
Add web application firewall rules to flag request parameters containing encoded scheme delimiters in URL-typed fields

Monitoring Recommendations

Monitor egress traffic from services that accept user-supplied URLs, correlating destinations against expected allowlists
Track application logs for URI validation failures and post-normalization host changes
Alert on HTTP responses containing raw CR/LF characters in headers derived from URI inputs

How to Mitigate CVE-2026-76172

Immediate Actions Required

Upgrade fast-uri to 2.4.5, 3.1.6, or 4.1.3 depending on the major version currently deployed
Audit application code paths that call fast-uri parse, resolve, or normalize functions on user-supplied input
Add defense-in-depth host allowlist checks after resolution, not only after initial parse

Patch Information

The issue is fixed in fast-uri versions 2.4.5, 3.1.6, and 4.1.3. The patched releases reject a scheme that is not valid after decoding, closing the parser-serializer differential. Refer to the OpenJS Foundation Security Advisories and the upstream GitHub Security Advisory GHSA-jqff-g426-hqxp for full remediation guidance.

Workarounds

Reject user-supplied URIs where the scheme string contains any percent character before passing to fast-uri
Enforce host allowlist checks against the output of resolve or normalize operations rather than the initial parse result
Strip or reject CR and LF characters from any URI-derived value before use in HTTP headers or downstream URLs

bash

# Upgrade fast-uri to a patched release
npm install fast-uri@^4.1.3
# or for the 3.x line
npm install fast-uri@^3.1.6
# or for the 2.x line
npm install fast-uri@^2.4.5