CVE-2026-75975 fast-uri CVE debrief

Who should care

Users of fast-uri library for Node.js, especially those who normalize untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement, should be aware of this vulnerability and take necessary actions to mitigate it. This includes upgrading to a patched version, validating bracketed IP literals against the full grammar, marking malformed literals as authority errors, monitoring for and blocking suspicious traffic, and implementing compensating controls for address-policy enforcement. Security teams and operators should review the affected scope, severity, and vendor guidance to determine the necessary actions for their environments. Vulnerability management and security teams should prioritize patching and verifying the mitigation of this vulnerability in their environments. Platform and asset owners should review and update their configurations to prevent exploitation. Monitoring and incident response teams should be prepared to detect and respond to potential attacks exploiting this vulnerability. IT and development teams should coordinate on patching and verifying the mitigation of this vulnerability in their environments. Compliance and risk management teams should review and update their policies and procedures to ensure that this vulnerability is properly addressed. Business stakeholders should be aware of the potential impact of this vulnerability on their operations and take necessary actions to mitigate it. System administrators and network operators should review and update their configurations to prevent exploitation. Security researchers and threat intelligence teams should monitor for and analyze potential attacks exploiting this vulnerability. Penetration testers and red teamers should test their environments for vulnerability to this attack. Blue teamers and defenders should be prepared to detect and respond to potential attacks exploiting this vulnerability. Compliance teams should review and update their policies and procedures to ensure that this vulnerability is properly addressed. Risk management teams should review and update their risk assessments to reflect the potential impact of this vulnerability. Audits,

Technical summary

The fast-uri library for Node.js has a custom parser for bracketed IPv6 literals that does not validate the complete IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded and a malformed attacker-controlled host to be turned into a different valid IPv6 destination. This vulnerability can lead to server-side request forgery and address-policy bypass. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3.

Defensive priority

Server-side request forgery and address-policy bypass vulnerabilities in fast-uri can be mitigated by upgrading to a patched version.

Recommended defensive actions

• Upgrade to fast-uri version 2.4.5, 3.1.6, or 4.1.3
• Validate bracketed IP literals against the full grammar
• Mark malformed literals as authority errors
• Monitor for and block suspicious traffic
• Implement compensating controls for address-policy enforcement

Evidence notes

The fast-uri library for Node.js has a custom parser for bracketed IPv6 literals that does not validate the complete IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. Affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.