CVE-2026-75975: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Impact
fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize('http://[::not-valid]/private') returns http://[::]/private, and [fc00::not-hex] and [fe80::not-hex] collapse to [fc00::] and [fe80::]. An application that normalizes an untrusted URL before an outbound request, redirect, or host-policy check can be routed to a local or private address such as loopback (::1), unique-local, or link-local. Because parse().error is unset for these inputs, checking it does not protect the consumer.
Patches
Upgrade to fast-uri 2.4.5, 3.1.6, or 4.1.3. Malformed IPv6 literals are now rejected with a host error instead of being normalized to a valid address.
Workarounds
Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri, or route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.
Other sources
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.3 - Compensating control
Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri.
- Compensating control
Route outbound requests against an explicit allowlist of addresses rather than trusting the normalized host.
Event History
Frequently Asked Questions
Which fast-uri versions contain the vulnerability, and which versions fix it?
Affected releases are 2.3.1 through before 2.4.5, 3.0.0 through before 3.1.6, and 4.0.0 through before 4.1.3. The fixes are available in 2.4.5, 3.1.6, and 4.1.3.
What conditions make an application practically exploitable?
An attacker must be able to supply a URL that the application normalizes before making outbound requests, following redirects, routing through a proxy, or enforcing an address policy. The malformed bracketed IPv6 authority can then be rewritten to a loopback or private IPv6 destination.
Can an application detect this issue by checking the parser error field?
No. The vulnerable parser does not set an error when it silently rewrites malformed bracketed IPv6 literals, so checking the parsed result's error field does not detect the rewrite.
How can I determine whether my application is exposed?
Check whether your dependency tree includes an affected fast-uri version and whether untrusted URLs reach code that uses fast-uri normalization for outbound HTTP requests, redirects, proxy routing, or destination-policy enforcement. Applications without such attacker-controlled URL flows are not described as having the SSRF path.