CVE-2026-75899: 
JavaScript vulnerability analysis and mitigation

CVE-2026-75899 is a Server-Side Request Forgery (SSRF) and host-policy bypass vulnerability in fast-uri, a URI parser for Node.js maintained under the OpenJS Foundation. The flaw stems from double percent-decoding of hostnames during normalize() or resolve() calls, allowing crafted URIs to resolve to unintended network destinations such as loopback addresses or cloud metadata endpoints. It affects versions 2.4.1–2.4.4, 3.1.2–3.1.5, and 4.0.0–4.1.2, and is classified as an incomplete fix for CVE-2026-6322. It was published on August 23–24, 2026, with patches released on September 2, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Github Advisory).

The root cause is CWE-174 (Double Decoding of the Same Data) combined with CWE-918 (SSRF). During a single normalize() or resolve() call, fast-uri decodes percent-escaped characters in the hostname once during parsing and a second time during authority recomposition — a behavior introduced by the fix for CVE-2026-6322. This violates RFC 3986 §2.4, which prohibits decoding the same string more than once. As a concrete example, normalize('http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/') returns http://localhost/, because the doubly-encoded sequence %25XX survives the first decode as %XX and is then fully decoded in the second pass. No authentication or user interaction is required; an attacker only needs to supply a crafted URI to an application that passes untrusted input through normalize() or resolve() before performing SSRF checks or host-allowlist validation (GitHub Advisory, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass host-allowlist checks, redirect validation logic, and SSRF defenses in any Node.js application that uses fast-uri to normalize or resolve untrusted HTTP-family URIs before routing. This can result in the server making outbound requests to internal resources such as loopback addresses (localhost/127.0.0.1) or cloud instance metadata endpoints (e.g., 169.254.169.254), potentially exposing sensitive internal services, credentials, or infrastructure metadata. The CVSS scoring reflects a high integrity impact with no confidentiality or availability impact at the library level, though downstream application impact may be more severe depending on what internal services are reachable (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure (Github Advisory). The vulnerability is network-exploitable with low attack complexity, requires no privileges or user interaction, and is automatable according to NVD SSVC analysis. The EPSS score is approximately 0.22% (12th percentile), indicating a low but non-negligible probability of exploitation within 30 days. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Github Advisory).

1. Identify a target application: Find a Node.js application that uses fast-uri versions 2.4.1–2.4.4, 3.1.2–3.1.5, or 4.0.0–4.1.2 and passes untrusted user-supplied URIs through normalize() or resolve() before performing SSRF checks or host-allowlist validation.
2. Craft a doubly percent-encoded URI: Construct a URI where the target hostname is double-encoded. For example, to target localhost, encode each character as %XX and then percent-encode the % sign as %25, yielding: http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/.
3. Submit the crafted URI: Supply the crafted URI as input to the vulnerable application endpoint (e.g., a URL redirect parameter, a webhook URL field, or any input that triggers URI normalization/resolution).
4. Bypass SSRF/allowlist check: The application's pre-normalization check sees the doubly-encoded host (e.g., %256c%256f...) and does not flag it as a blocked destination. After normalize() processes it twice, the resolved URI becomes http://localhost/.
5. Achieve SSRF: The application routes the outbound request to the unintended internal destination (e.g., localhost, 169.254.169.254 for cloud metadata), potentially retrieving sensitive internal data or interacting with internal services (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from the application server to loopback addresses (127.0.0.1, ::1, localhost) or cloud metadata endpoints (169.254.169.254, fd00:ec2::254); outbound requests to internal RFC-1918 address ranges originating from the Node.js application process.
• Logs: Application access logs showing inbound requests with URI parameters containing double-encoded percent sequences (e.g., %2525, %256c, %256f); server-side HTTP client logs recording requests to internal hostnames or IPs that should not be reachable from the application.
• Application Behavior: Responses or errors from internal services appearing in application output or error logs, indicating successful SSRF redirection to an unintended host (GitHub Advisory).

Upgrade fast-uri to a patched version: 2.4.5 (for 2.4.x users), 3.1.6 (for 3.1.x users), or 4.1.3 (for 4.x users). These releases normalize percent escapes only once and preserve encoded percent signs, preventing the double-decode attack. As an interim workaround if upgrading is not immediately possible, reject any untrusted URI whose host component contains an encoded percent sign (%25) before passing it to normalize() or resolve(). Applying strict input validation and SSRF defenses at the network layer (e.g., blocking outbound requests to internal IP ranges) provides additional defense-in-depth (GitHub Advisory, Github Advisory).

The vulnerability was reported by security researcher NotAFlightRisk, with remediation developed by mcollina and reviewed by UlisesGascon from the Fastify/OpenJS ecosystem. The advisory was published under the OpenJS Foundation CNA. Community tracking was noted across platforms including Mastodon (infosec.exchange) and security aggregators such as VulDB, Tenable (Nessus plugin 339304), INCIBE-CERT, and AusCERT (ESB-2026.10308). Red Hat also referenced the vulnerability in a security advisory for hardened images (GitHub Advisory).