← Terug naar overzicht

CVE-2026-76172 affects fast-uri, a URI parser for Node.js, across versions 2.3.1–2.4.4, 3.0.0–3.1.5, and 4.0.0–4.1.2. The vulnerability stems from a legacy decoding pass over the URI scheme component that decodes percent-encoded characters without re-escaping them, causing a mismatch between parsed and serialized output. An attacker can craft a URI with percent-encoded slashes in the scheme to make the parser report no authority/host, while serialization emits an attacker-controlled network-path reference with an arbitrary host. This discrepancy enables off-site redirects, server-side request forgery (SSRF), and address-policy bypasses in applications that rely on the parsed host for security decisions. Additionally, the legacy decoder expands non-standard escape forms, allowing bypass of upstream filters, and control characters in the scheme can be emitted as raw CRLF sequences. Fixed versions 2.4.5, 3.1.6, and 4.1.3 reject schemes that are invalid after decoding. Users are strongly advised to upgrade immediately.

Affected products

  • Node.js
  • fast-uri 2.3.1–2.4.4
  • fast-uri 3.0.0–3.1.5
  • fast-uri 4.0.0–4.1.2

Related CVE's

  • CVE-2026-76172

Categories

  • Supply Chain & Dependencies
  • Web Technologies