{"uuid": "a7de274c-8f2e-4cd2-913f-48f59bb14762", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75975", "type": "seen", "source": "https://gist.github.com/alon710/4dc17918da62d2577fc435c04c7ff596", "content": "# CVE-2026-75975: CVE-2026-75975: Server-Side Request Forgery (SSRF) and Address-Policy Bypass via Malformed IPv6 Parser in fast-uri\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75975\n\n## Summary\nA critical parser differential vulnerability in the Node.js fast-uri library allows unauthenticated remote attackers to bypass address-validation filters and perform Server-Side Request Forgery (SSRF). The library fails to validate complete IPv6 grammar inside bracketed literals, silently truncating invalid trailing characters and normalising malformed hosts into valid loopback or private addresses.\n\n## TL;DR\nThe fast-uri library's IPv6 parser silently normalises invalid IP literals like [::not-valid] to [::] (the unspecified loopback address). Attackers exploit this parser differential to bypass security blocklists, redirecting outbound HTTP requests to internal networks or local services.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20, CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Maturity**: Proof of Concept (PoC)\n- **CISA KEV Status**: Not Listed\n- **Impact**: Integrity (High), Server-Side Request Forgery (SSRF)\n\n## Affected Systems\n\n- fast-uri (v2.3.1 - v2.4.4)\n- fast-uri (v3.0.0 - v3.1.5)\n- fast-uri (v4.0.0 - v4.1.2)\n- **fast-uri**: >= 2.3.1, < 2.4.5 (Fixed in: `2.4.5`)\n- **fast-uri**: >= 3.0.0, < 3.1.6 (Fixed in: `3.1.6`)\n- **fast-uri**: >= 4.0.0, < 4.1.3 (Fixed in: `4.1.3`)\n\n## Mitigation\n\n- Upgrade the fast-uri dependency to patched versions: 2.4.5, 3.1.6, or 4.1.3.\n- Implement regex validation on the input URL to reject any bracketed hosts containing non-hexadecimal or non-colon characters.\n- Utilize package resolution overrides to force transitive dependencies to use the fixed versions.\n\n**Remediation Steps:**\n1. Step 1: Check your package lockfile for references to fast-uri.\n2. Step 2: Run 'npm install fast-uri@latest' or force the dependency update in package.json using overrides.\n3. Step 3: Ensure that any parsing logic verifies the '.error' field of the output returned by the parse function.\n4. Step 4: Redeploy the application and monitor egress HTTP requests for loopback resolution patterns.\n\n## References\n\n- [NVD - CVE-2026-75975](https://nvd.nist.gov/vuln/detail/CVE-2026-75975)\n- [GHSA-f65p-4m7j-42xc](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n- [OpenJS Foundation Advisories](https://cna.openjsf.org/security-advisories.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75975) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T17:33:14.496875Z"}