Listen to this Post
The `fast-uri` library, a popular URI parser for Node.js, is vulnerable to a Server-Side Request Forgery (SSRF) attack due to a double percent-decoding flaw. This vulnerability, identified as CVE-2026-75899, is an incomplete fix variant of the earlier CVE-2026-6322. The previous patch for CVE-2026-6322, which addressed host confusion via percent-encoded authority delimiters, inadvertently introduced a second decode operation during URI normalization.
The core of the issue lies in how the `normalize()` and `resolve()` functions process hostnames. During a single call, the library decodes percent-encoded characters twice: first during the parsing stage and again during authority recomposition. This double decoding allows a maliciously crafted, nested percent-encoded hostname to survive the first decode and be transformed into a live, internal address by the second. For example, the seemingly benign input http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/` is incorrectly normalized tohttp://localhost/`.
This behavior creates a critical security gap. Applications that normalize or resolve an untrusted URI before performing an SSRF check, redirect validation, or host allowlist can be tricked. An attacker can use this flaw to steer the application to a different, unauthorized destination, such as internal loopback addresses (e.g., localhost) or a cloud metadata endpoint. This allows the attacker to bypass security controls and potentially access sensitive internal services or data.
DailyCVE Form:
Platform: Node.js
Version: >=2.4.1<2.4.5, >=3.1.2<3.1.6, >=4.0.0<4.1.3
Vulnerability: Double Percent-Decoding SSRF
Severity: High (CVSS 7.5)
Date: Sep 2, 2026
Prediction: Patch already available
What Undercode Say:
Analytics
- CWE IDs: CWE-174 – Double Decoding of the Same Data, CWE-918 – Server-Side Request Forgery (SSRF)
- Attack Vector: Network
- EPSS Score: 0.23% (probability of exploitation in next 30 days is very low)
- Exploitation Status: No known exploits available; Proof of Concept exists
- CISA KEV: Not Listed
Exploit: (Educational Purposes!)
To understand how this vulnerability works, consider the following example using the `fast-uri` library in a Node.js environment:
1. Vulnerable Code Example:
const fastUri = require('fast-uri');
const maliciousURI = 'http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/';
const normalizedURI = fastUri.normalize(maliciousURI);
console.log(normalizedURI);
// Output: http://localhost/
This demonstrates how a URI that appears to point to a benign, encoded string is normalized to localhost.
2. Bypassing an SSRF Filter:
const fastUri = require('fast-uri');
const isSafe = (uri) => !uri.includes('localhost') && !uri.includes('169.254.169.254');
const userInput = 'http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/';
// The SSRF check passes because the input does not contain 'localhost'.
if (isSafe(userInput)) {
// The application then normalizes the URI, which resolves to localhost.
const finalURI = fastUri.normalize(userInput);
// fetch(finalURI) would now make a request to localhost, bypassing the check.
console.log(<code>Making request to: ${finalURI}</code>);
// Output: Making request to: http://localhost/
}
This example shows how an attacker can craft an input that passes a superficial security check, only to have it resolve to a blocked internal address after normalization.
Protection:
To protect your applications from this vulnerability, take the following steps:
– Upgrade Immediately: Update the `fast-uri` library to a patched version. The fixes are available in versions 2.4.5, 3.1.6, and 4.1.3.
– Implement Pre-validation: As a workaround, reject any untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to `normalize()` or resolve().
– Unify Parsing Logic: Ensure that the same library and parsing logic are used for both security validation (e.g., SSRF checks) and the actual request execution.
– Audit Dependencies: Check your `package-lock.json` or `yarn.lock` files for any projects depending on vulnerable versions of fast-uri.
Impact:
- SSRF Bypass: An attacker can bypass SSRF protections, redirect validation, and host allowlists.
- Access to Internal Services: Successful exploitation can lead to unauthorized access to internal network services, including loopback addresses (e.g.,
localhost) and cloud metadata endpoints. - Data Tampering: The impact is confined to the application but can result in the modification of data.
- Integrity Subversion: The vulnerability allows for integrity subversion, potentially leading to further attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
