CVE-2026-75931: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Vulnerability summary
CVE-2026-75931 is a high (CVSS 7.5) Interpretation Conflict vulnerability in fast-uri. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 34% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 24-08-2026PublishedVulnerability first disclosed.
- 24-08-2026Last modifiedVulnerability information updated.
Description
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a patched version.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.40% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard68 products
- arangodb-3.12< 3.12.11-r1
- gitlab-rails-ce-fips-19.1< 19.1.7-r5
- keep-ui< 0.54.2-r8
- keep-ui-fips< 0.54.2-r11
- kibana-9.2< 9.2.8-r20
Wolfi19 products
- nextcloud-server-32< 32.0.14-r1
- opensearch-dashboards-3< 3.8.0-r1
- opensearch-dashboards-3-alerting-dashboards-plugin< 3.8.0-r1
- opensearch-dashboards-3-anomaly-detection-dashboards-plugin< 3.8.0-r1
- opensearch-dashboards-3-dashboards-maps< 3.8.0-r1
Debian1 product
- node-ajvAll versions (No fix recorded) | < 8.20.0~ds+~cs7.1.4-1
Fast-uri1 product
- fast-uri≥ 2.4.2, < 2.4.5 | ≥ 3.1.3, < 3.1.6 | ≥ 4.0.1, < 4.1.3
Npm1 product
- fast-uri≥ 2.4.2, < 2.4.5 | ≥ 3.1.3, < 3.1.6 | ≥ 4.0.1, < 4.1.3
Openjsf1 product
- fast-uri≥ 2.4.2, < 2.4.5 | ≥ 3.1.3, < 3.1.6 | ≥ 4.0.1, < 4.1.3
Ubuntu1 product
- node-ajvAll versions (No fix recorded)
7 vendors · 92 products
References
14 links- github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8REPORTAdvisoryWEBVendor AdvisoryMitigation
