CVE-2026-75899: fast-uri SSRF via Repeated Hostname Decoding

TL;DR: fast-uri decodes a hostname twice in a single normalize() or resolve() call. Nested percent-encoding that looks like a harmless host becomes a live destination such as localhost. GitHub rates GHSA-fph4-wmhf-6fwf High, CVSS 3.1 7.5. This is an incomplete-fix variant of CVE-2026-6322. The same 2.4.5 / 3.1.6 / 4.1.3 train also closes three sibling High issues (malformed IPv6, IDN host confusion, percent-encoded scheme). Upgrade. This is not remote code execution. Not in CISA KEV.

What happened

fast-uri is a dependency-free RFC 3986 URI toolbox maintained by Fastify. npm reported 123,372,933 weekly downloads for the week of 2026-08-17/23. Most Node apps do not depend on it directly. They get it as a transitive dependency through Fastify, Ajv, or another URI helper, then call normalize() or resolve() on a user-supplied URL before a host check, a redirect allowlist, or an outbound request.

In affected versions the hostname is decoded once during parsing and again during authority recomposition. Nested percent-encoding that spells a loopback or other internal name survives the first pass and becomes that live host on the second. RFC 3986 section 2.4 says an implementation must not decode the same string more than once. The GitHub advisory has the concrete encoded input.

GitHub published GHSA-fph4-wmhf-6fwf on 2026-08-23. Patched package versions landed the same day: 4.1.3 at 01:34:36Z, 3.1.6 at 01:42:00Z, and 2.4.5 at 01:42:52Z. CVE-2026-75899 was assigned on 2026-08-24T09:40:19.801Z. Impact needs an application that routes, allowlists, or fetches based on the output of normalize() or resolve(). The library alone does not open a network socket.

Affected versions

• Package: npm fast-uri (vendor Fastify)
• Affected: >=2.4.1 <2.4.5 || >=3.1.2 <3.1.6 || >=4.0.0 <4.1.3
• Fixed: 2.4.5, 3.1.6, 4.1.3
• CWE: CWE-174 (Double Decoding of the Same Data) and CWE-918 (Server-Side Request Forgery)
• CVSS: GitHub GHSA-fph4-wmhf-6fwf, High, CVSS 3.1 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). HOL Guard's evidence pack still has cvssScore: null. Not listed in CISA KEV.
• Preconditions: an app that trusts the host after normalize() or resolve() for policy, redirects, or outbound requests. Not RCE by itself.

The same 2.4.5 / 3.1.6 / 4.1.3 train also closes three sibling High advisories. Treat them as one upgrade:

• CVE-2026-75975 (GHSA-f65p-4m7j-42xc): malformed IPv6 literal truncation. Affected >=2.3.1 <2.4.5 || >=3.0.0 <3.1.6 || >=4.0.0 <4.1.3.
• CVE-2026-75931 (GHSA-5jgf-p345-68v8): skipped IDN canonicalization on scheme-relative references. Affected >=2.4.2 <2.4.5 || >=3.1.3 <3.1.6 || >=4.0.1 <4.1.3.
• CVE-2026-76172 (GHSA-jqff-g426-hqxp): percent-encoded scheme host confusion. Affected >=2.3.1 <2.4.5 || >=3.0.0 <3.1.6 || >=4.0.0 <4.1.3.

How to fix

Upgrade to a patched release on your line:

npm install [email protected]

If you pin the 3.x line, install 3.1.6. If you pin the 2.x line, install 2.4.5. Confirm where it lands in the tree:

npm ls fast-uri

If a parent still pulls an affected version, pin it.

{
  "overrides": {
    "fast-uri": "4.1.3"
  }
}

GitHub's workaround of rejecting hosts that contain an encoded percent sign (%25) before normalize() or resolve() covers this CVE only. It does not close the three sibling High issues on the same train. Upgrade.

Technical details

Authority handling in affected builds applies percent-decoding to the hostname during parse, then applies it again when the authority is recomposed for normalize() or resolve(). Nested encoding therefore crosses a policy boundary that inspected the once-decoded form. That is CWE-174 feeding CWE-918 when the caller uses the resulting host for SSRF controls, redirects, or fetches.

The second decode arrived with the encoded-authority-delimiter fix for CVE-2026-6322. CVE-2026-75899 is the incomplete-fix follow-on, not a separate package line.

HOL Guard first saw the CVE record at 2026-08-24T09:50:22.229Z, after the CVE List publishedAt of 2026-08-24T09:40:19.801Z. The evidence pack still has cvssScore: null, editorialStatus: not_started, and noindex. The 7.5 High score above comes from GHSA-fph4-wmhf-6fwf, not from an NVD analysis score in the HOL pack.

This article is the operator write-up: what broke, who is affected, and how to fix it. The HOL Guard evidence page is the source record for CVE-2026-75899.

References

• GHSA-fph4-wmhf-6fwf (CVE-2026-75899)
• GHSA-f65p-4m7j-42xc (CVE-2026-75975)
• GHSA-5jgf-p345-68v8 (CVE-2026-75931)
• GHSA-jqff-g426-hqxp (CVE-2026-76172)
• CVE-2026-75899 CVE List record
• npm fast-uri