Improper Handling of URL Encoding (Hex Encoding) in fast-uri - CVE-2026-76172
Published: August 25, 2026
Vulnerability identifier: #VU145064
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76172
CWE-ID: CWE-177
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass host validation and inject carriage return and line feed characters into output.
The vulnerability exists due to improper handling of url encoding in the scheme component normalization logic when normalizing or resolving untrusted URLs. A remote attacker can supply a specially crafted percent-encoded scheme to bypass host validation and inject carriage return and line feed characters into output.
Applications that treat a missing authority as same-origin during redirect checks, host allowlist enforcement, or outbound request decisions are particularly exposed.
Affected software
fast-uri
How to mitigate CVE-2026-76172
Install security update from vendor's website.
fast-uri - addressed in versions 2.4.5, 3.1.6, 4.1.3