CVE-2026-75899 affects fast-uri, a URI parser for Node.js, where percent-encoded hostnames are decoded twice during parsing and authority recomposition. This double-decoding allows doubly encoded input to resolve to a different network destination, such as a loopback address, violating RFC 3986 section 2.4. The flaw enables server-side request forgery (SSRF) and host-policy bypass in applications that normalize or resolve untrusted HTTP-family URIs before routing or validation. It is an incomplete fix variant of CVE-2026-6322. Affected versions span 2.4.1 to 2.4.4, 3.1.2 to 3.1.5, and 4.0.0 to 4.1.2. Patches are available in versions 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes only once and preserve encoded percent signs. Users are strongly advised to upgrade immediately.