CVE-2026-75975: 
Grafana vulnerability analysis and mitigation

CVE-2026-75975 is a Server-Side Request Forgery (SSRF) vulnerability in fast-uri, a URI parser for Node.js maintained under the Fastify/OpenJS Foundation ecosystem. The flaw arises from incomplete validation of bracketed IPv6 literals, allowing malformed attacker-controlled host values to be silently normalized into valid private or loopback IPv6 addresses. Affected versions are 2.3.1–<2.4.5, 3.0.0–<3.1.6, and 4.0.0–<4.1.3. It was published on August 24, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is improper input validation (CWE-20) in fast-uri's custom parser for bracketed IPv6 literals, which does not enforce the complete RFC 3986 grammar. When a malformed literal such as [::not-valid] or [fc00::not-hex] is parsed, invalid trailing characters are silently discarded, collapsing the address to a valid IPv6 destination (e.g., [::], [fc00::], [fe80::]). Critically, parse().error is not set for these malformed inputs, so application-level error checks cannot detect the rewrite. An attacker supplying a crafted URL to an application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can cause the server to connect to loopback, unique-local, or link-local IPv6 addresses (CWE-918) (GitHub Advisory).

Successful exploitation enables an attacker to redirect server-side HTTP requests to local or private IPv6 addresses (e.g., ::1 loopback, fc00::/7 unique-local, fe80::/10 link-local), bypassing host-policy and address allowlist enforcement. This SSRF primitive can expose internal services not intended to be reachable from the internet, potentially leading to unauthorized access to internal APIs, metadata services, or other backend infrastructure. Integrity is the primary impact (CVSS I:High), with no direct confidentiality or availability impact scored, though chained exploitation could escalate to data exfiltration or lateral movement depending on the application context (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability is unauthenticated and network-exploitable with low attack complexity, and NVD SSVC assessment marks it as automatable. The EPSS score is approximately 0.40%, indicating a low but non-negligible probability of exploitation in the near term. CVE-2026-75975 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify target application: Locate a Node.js application that uses fast-uri (versions 2.3.1–<2.4.5, 3.0.0–<3.1.6, or 4.0.0–<4.1.3) to normalize or parse untrusted URLs before making outbound HTTP requests, performing redirects, or enforcing host-based access policies.
2. Craft malformed IPv6 URL: Construct a URL with a malformed bracketed IPv6 literal, such as http://[::not-valid]/internal-path or http://[fc00::not-hex]/admin. The invalid trailing characters cause fast-uri to silently truncate the address to a valid IPv6 destination (e.g., [::] or [fc00::).
3. Submit crafted URL to the application: Supply the malformed URL as user-controlled input to any application endpoint that accepts URLs for outbound requests, proxy routing, or redirect logic.
4. Bypass address-policy checks: Because parse().error is not set, any application-level validation that checks the error field will pass, and the normalized (rewritten) host will be used for the outbound connection.
5. Reach internal/private IPv6 target: The server issues an HTTP request to the attacker-chosen private or loopback IPv6 address (e.g., ::1 for loopback services, fc00:: for unique-local ranges), potentially accessing internal APIs, admin panels, or cloud metadata endpoints (GitHub Advisory).

• Network: Outbound HTTP/HTTPS connections from the Node.js application server to IPv6 loopback (::1), unique-local (fc00::/7), or link-local (fe80::/10) addresses that are unexpected or not part of normal application traffic.
• Logs: Application or web server access logs showing inbound requests with URL parameters containing bracketed IPv6 literals with non-hex or malformed trailing characters (e.g., [::not-valid], [fc00::not-hex], [fe80::not-hex]).
• Logs: Internal service access logs (e.g., metadata service, admin APIs) showing requests originating from the application server process without a corresponding legitimate user action.
• Application Behavior: Absence of error responses or exceptions when URLs with malformed IPv6 literals are submitted, indicating silent normalization rather than rejection (GitHub Advisory).

Upgrade fast-uri to one of the patched versions: 2.4.5, 3.1.6, or 4.1.3. These releases validate bracketed IPv6 literals against the full RFC 3986 grammar and mark malformed literals as authority errors rather than silently normalizing them. As a workaround where immediate upgrade is not possible, reject any untrusted URLs whose host component is a bracketed IPv6 literal before passing them to fast-uri, or enforce outbound request routing against an explicit allowlist of permitted IP addresses rather than trusting the normalized host value (GitHub Advisory).

The advisory was published by mcollina (Matteo Collina, Node.js TSC member and Fastify maintainer) on August 23, 2026, with UlisesGascon credited as a remediation developer, indicating prompt response from the Fastify core team. No significant broader media coverage or notable external researcher commentary has been identified beyond the official GitHub Security Advisory at the time of this report (GitHub Advisory).