CVE-2026-75931

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names (IDN) to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an application might validate a URI against a security policy using one hostname, but then resolve to a different, potentially malicious, hostname. This discrepancy could allow an attacker to bypass security policies and access unauthorized resources.

Red Hat evaluates this vulnerability as having an Important severity because unauthenticated remote attackers could supply crafted scheme-relative input to evade hostname restrictions, potentially facilitating policy bypass or improper routing without prior credentials. Within Red Hat offerings, fast-uri is packaged as a bundled dependency within several administrative web interfaces and console extensions. Actual exploitability depends on whether an affected service relies on the library to enforce origin filtering or domain allowlists against untrusted network requests.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.