CVE-2026-76172

A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers (URIs) in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An attacker can exploit this by crafting a malicious URI, causing the parser to misinterpret the host, which can lead to serious security risks. These risks include unauthorized redirection to external websites, server-side request forgery (SSRF) where the application makes unintended requests to internal or external resources, and bypassing security policies.

A host confusion vulnerability was found in fast-uri, a URI parser for Node.js. The parser runs a legacy decoding pass over the scheme component and never re-escapes the result. As a consequence, an input whose scheme carries percent-encoded slashes parses as having no authority (undefined host), yet resolving or normalizing that same input emits a network-path reference with an attacker-chosen authority. Applications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision can be steered to an attacker-controlled domain, enabling server-side request forgery (SSRF), open redirect, or address-policy bypass. Additionally, a normalized URI in a response header can carry injected carriage return line feed (CRLF) characters, enabling HTTP response splitting attacks such as cache poisoning or session hijacking. This issue affects Red Hat products that bundle fast-uri as part of their Node.js dependencies. Fixed versions are available: fast-uri 2.4.5, 3.1.6, and 4.1.3.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams.