SB2026082529 - Multiple vulnerabilities in fast-uri

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082529

SB2026082529 - Multiple vulnerabilities in fast-uri

Published: August 25, 2026

Security Bulletin ID SB2026082529
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Improper Handling of URL Encoding (Hex Encoding) (CVE-ID: CVE-2026-76172)

CWE-ID: CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host validation and inject carriage return and line feed characters into output.

The vulnerability exists due to improper handling of url encoding in the scheme component normalization logic when normalizing or resolving untrusted URLs. A remote attacker can supply a specially crafted percent-encoded scheme to bypass host validation and inject carriage return and line feed characters into output.

Applications that treat a missing authority as same-origin during redirect checks, host allowlist enforcement, or outbound request decisions are particularly exposed.


2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-75975)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host-policy checks and perform server-side request forgery.

The vulnerability exists due to improper input validation in the IPv6 literal normalization logic of fast-uri when normalizing untrusted URLs containing malformed bracketed IPv6 literals. A remote attacker can supply a specially crafted URL to bypass host-policy checks and perform server-side request forgery.

Malformed bracketed IPv6 literals with invalid trailing text are silently truncated to different valid IPv6 addresses, and parse().error is not set for these inputs.


3) Double Decoding of the Same Data (CVE-ID: CVE-2026-75899)

CWE-ID: CWE-174 - Double Decoding of the Same Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to double decoding of the same data in the fast-uri normalize() and resolve() hostname handling logic when processing a URI with a nested percent-encoded host. A remote attacker can supply a specially crafted URI to perform server-side request forgery.

The issue can cause the hostname to be interpreted as a different destination than the input appears to contain, including internal addresses such as loopback or a cloud metadata endpoint.


4) Interpretation Conflict (CVE-ID: CVE-2026-75931)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host-based policy checks.

The vulnerability exists due to interpretation conflict in the resolve() host canonicalization logic when resolving scheme-relative references against a scheme-bearing base. A remote attacker can supply a specially crafted scheme-relative reference to bypass host-based policy checks.

Re-parsing the resolved URI can yield a different host than the one returned by resolve().


Remediation

Install update from vendor's website.

References