CVE-2026-75975: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize('http://[::not-valid]/private') returns http://[::]/private, and [fc00::not-hex] and [fe80::not-hex] collapse to [fc00::] and [fe80::]. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (::1), unique-local, or link-local. Because parse().error is unset for these inputs, checking it does not protect the consumer.
References
- cna.openjsf.org/security-advisories.html
- github.com/advisories/GHSA-f65p-4m7j-42xc
- github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595
- github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f
- github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799
- github.com/fastify/fast-uri/releases/tag/v2.4.5
- github.com/fastify/fast-uri/releases/tag/v3.1.6
- github.com/fastify/fast-uri/releases/tag/v4.1.3
- github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc
- nvd.nist.gov/vuln/detail/CVE-2026-75975
Code Behaviors & Features
Detect and mitigate CVE-2026-75975 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →