CVE-2026-76172: 
Grafana vulnerability analysis and mitigation

CVE-2026-76172 is a host confusion vulnerability in fast-uri, a URI parser for Node.js, caused by improper handling of percent-encoded characters in the scheme component. During parsing, the library runs a legacy unescape() decoding pass over the scheme and serializes the result verbatim without re-escaping or re-validating it against RFC 3986 grammar. This allows an attacker-crafted URI (e.g., %2f%2fevil.example:/pwn) to parse with no authority, yet resolve or normalize to an attacker-chosen host, enabling open redirects, SSRF, or address-policy bypasses. Affected versions are 2.3.1–<2.4.5, 3.0.0–<3.1.6, and 4.0.0–<4.1.3. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-177 (Improper Handling of URL Encoding / Hex Encoding): the parser applies the legacy JavaScript unescape() function to the scheme component and writes the decoded result back to the output without re-escaping or validating it as a valid RFC 3986 scheme. This creates a parse/serialize inconsistency — parse() sees no authority (host is undefined), while resolve() and normalize() emit a network-path reference with an attacker-controlled authority. The library also accepts non-standard %uXXXX escape forms (e.g., %u002f%u002fevil.example:/pwn), widening the bypass past upstream filters. Additionally, control characters such as %0d%0a in the scheme can reach serialized output as raw CR LF, enabling HTTP response header injection (GitHub Advisory).

Successful exploitation can lead to open redirects, server-side request forgery (SSRF), and address/allowlist policy bypasses in applications that normalize or resolve untrusted URIs before performing security checks. Applications that treat a missing authority as same-origin are particularly at risk, as they may be silently redirected to an attacker-chosen host. Additionally, the CR LF injection vector allows attackers to inject arbitrary headers into HTTP responses, potentially enabling cache poisoning or session fixation attacks (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment classifies exploitation as "none" currently, and the EPSS score is 0.0, indicating low near-term exploitation probability. The vulnerability is automatable (no user interaction required) and exploitable by unauthenticated remote attackers with low attack complexity, making it a candidate for future weaponization if widely deployed applications are identified as vulnerable. It is not currently listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Identify target: Find a Node.js application using a vulnerable version of fast-uri (2.3.1–<2.4.5, 3.0.0–<3.1.6, or 4.0.0–<4.1.3) that normalizes or resolves user-supplied URIs before performing a redirect, allowlist check, or outbound request.
2. Craft malicious URI: Construct a URI with percent-encoded slashes in the scheme component, e.g., %2f%2fevil.example:/pwn or using the %uXXXX form: %u002f%u002fevil.example:/pwn.
3. Submit to application: Supply the crafted URI as input to the vulnerable endpoint (e.g., a redirect parameter, URL normalization API, or SSRF-prone fetch call).
4. Trigger parse/serialize discrepancy: The application calls parse() on the input — host is undefined and no error is raised, passing any allowlist check that treats missing authority as safe. When resolve() or normalize() is subsequently called, the output becomes //evil.example:/pwn, which re-parses with host = evil.example.
5. Achieve objective: The application issues an outbound request or redirect to the attacker-controlled host, achieving SSRF or open redirect. For header injection, embed %0d%0a in the scheme to inject CR LF into a serialized response header (GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from the application server to external or internal hosts not in the normal traffic baseline; redirect responses (3xx) pointing to external domains not matching the application's allowlist.
• Logs: Application access logs showing URI parameters containing %2f%2f, %u002f, %u002f, or %0d%0a sequences in scheme positions; error logs showing host: undefined parse results followed by successful resolution to external hosts.
• Application Behavior: Redirect chains terminating at unexpected external domains; HTTP response headers containing unexpected CR LF sequences or injected header fields (GitHub Advisory).

Upgrade fast-uri to one of the patched versions: 2.4.5, 3.1.6, or 4.1.3, depending on the release line in use. The fix causes the library to reject any scheme that is not valid after decoding, eliminating the parse/serialize discrepancy. No configuration-based workarounds are available — the vendor explicitly states that upgrading is the only remediation. As an interim defense-in-depth measure, applications should validate that parse().host matches the expected host after calling resolve() or normalize(), not before (GitHub Advisory).

The advisory was published by Matteo Collina (mcollina), a prominent Node.js core contributor and Fastify maintainer, with Ulises Gascón as remediation reviewer and YashvantHange credited as the reporter. No significant broader media coverage or social media discussion has been identified beyond standard CVE aggregator pickup as of the disclosure date (GitHub Advisory).