Double Decoding of the Same Data in fast-uri - CVE-2026-75899

Vulnerability identifier: #VU145068

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-75899

CWE-ID: CWE-174

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to double decoding of the same data in the fast-uri normalize() and resolve() hostname handling logic when processing a URI with a nested percent-encoded host. A remote attacker can supply a specially crafted URI to perform server-side request forgery.

The issue can cause the hostname to be interpreted as a different destination than the input appears to contain, including internal addresses such as loopback or a cloud metadata endpoint.

fast-uri
webMethods API Gateway
ApplinX
QRadar Threat Intelligence
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Bitbucket Data Center
Jira Software Data Center
Jira Service Management Data Center
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
cockpit-image-builder (Red Hat package)

Install security update from vendor's website.

fast-uri - addressed in versions 2.4.5, 3.1.6, 4.1.3
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3
Bitbucket Data Center - update to 9.4.23
Jira Software Data Center - update to 10.3.25
Jira Service Management Data Center - update to 10.3.25
webMethods API Gateway - update to 11.1 Fix13
QRadar Threat Intelligence - update to 2.6.0
cockpit-image-builder (Red Hat package) - update to 94.4-1.el10_2

• https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf

• Multiple vulnerabilities in fast-uri
• Multiple vulnerabilities in IBM ApplinX
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Red Hat Enterprise Linux 10 update for cockpit-image-builder
• Multiple vulnerabilities in Automation Assets in IBM Cloud Pak for Integration (CP4I)
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM webMethods API Gateway