https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 22 Sep 2026 15:55:26 +0000 https://vulnerability.circl.lu/sighting/df3b9443-53df-447d-ba4e-6d758c88a49b/export {"uuid": "df3b9443-53df-447d-ba4e-6d758c88a49b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://gist.github.com/alon710/9abc2886db3d6d53b0a6da8c0c0bb7fc", "content": "# CVE-2026-75899: CVE-2026-75899: Double-Decoding Host Bypass and SSRF in fast-uri\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75899\n\n## Summary\nA double-decoding vulnerability in the fast-uri package allows unauthenticated remote attackers to bypass host-policy validation and conduct Server-Side Request Forgery (SSRF) attacks by submitting nested percent-encoded URI strings.\n\n## TL;DR\nThe fast-uri package redundantly decodes host components twice across the parsing and recomposition lifecycle. Attackers can leverage nested percent-encoded host strings to bypass security boundary checks, leading to unauthenticated SSRF to internal network nodes and cloud metadata endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-174 / CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00234\n- **Impact Type**: Integrity (SSRF / Host Bypass)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications running fast-uri dependency packages < 2.4.5\n- Node.js applications running fast-uri dependency packages >= 3.1.2 and < 3.1.6\n- Node.js applications running fast-uri dependency packages >= 4.0.0 and < 4.1.3\n- **fast-uri**: >= 2.4.1 < 2.4.5 (Fixed in: `2.4.5`)\n- **fast-uri**: >= 3.1.2 < 3.1.6 (Fixed in: `3.1.6`)\n- **fast-uri**: >= 4.0.0 < 4.1.3 (Fixed in: `4.1.3`)\n\n## Mitigation\n\n- Upgrade the fast-uri package to patched versions 2.4.5, 3.1.6, or 4.1.3 depending on the respective dependency branch\n- Implement deep input validation to reject hostnames containing raw percent signs (%) prior to passing them to parsing and recomposition routines\n- Verify transitive dependencies (such as fastify and related plugins) to confirm no older versions of fast-uri are pulled into the project lockfile\n\n**Remediation Steps:**\n1. Identify the current installed version of fast-uri by inspecting package-lock.json or yarn.lock\n2. Run the upgrade command: npm install fast-uri@4.1.3 (or @3.1.6 / @2.4.5 depending on your major version pin)\n3. Re-generate package lockfiles and run npm audit to confirm the security advisory is resolved\n4. Deploy the updated application to staging environments and execute validation test scripts containing nested percent-encoded vectors to ensure functionality remains normal\n\n## References\n\n- [GitHub Security Advisory (GHSA-fph4-wmhf-6fwf)](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD Vulnerability Details - CVE-2026-75899](https://nvd.nist.gov/vuln/detail/CVE-2026-75899)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75899) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T18:33:43.506559Z"} {"uuid": "df3b9443-53df-447d-ba4e-6d758c88a49b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://gist.github.com/alon710/9abc2886db3d6d53b0a6da8c0c0bb7fc", "content": "# CVE-2026-75899: CVE-2026-75899: Double-Decoding Host Bypass and SSRF in fast-uri\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75899\n\n## Summary\nA double-decoding vulnerability in the fast-uri package allows unauthenticated remote attackers to bypass host-policy validation and conduct Server-Side Request Forgery (SSRF) attacks by submitting nested percent-encoded URI strings.\n\n## TL;DR\nThe fast-uri package redundantly decodes host components twice across the parsing and recomposition lifecycle. Attackers can leverage nested percent-encoded host strings to bypass security boundary checks, leading to unauthenticated SSRF to internal network nodes and cloud metadata endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-174 / CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00234\n- **Impact Type**: Integrity (SSRF / Host Bypass)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications running fast-uri dependency packages < 2.4.5\n- Node.js applications running fast-uri dependency packages >= 3.1.2 and < 3.1.6\n- Node.js applications running fast-uri dependency packages >= 4.0.0 and < 4.1.3\n- **fast-uri**: >= 2.4.1 < 2.4.5 (Fixed in: `2.4.5`)\n- **fast-uri**: >= 3.1.2 < 3.1.6 (Fixed in: `3.1.6`)\n- **fast-uri**: >= 4.0.0 < 4.1.3 (Fixed in: `4.1.3`)\n\n## Mitigation\n\n- Upgrade the fast-uri package to patched versions 2.4.5, 3.1.6, or 4.1.3 depending on the respective dependency branch\n- Implement deep input validation to reject hostnames containing raw percent signs (%) prior to passing them to parsing and recomposition routines\n- Verify transitive dependencies (such as fastify and related plugins) to confirm no older versions of fast-uri are pulled into the project lockfile\n\n**Remediation Steps:**\n1. Identify the current installed version of fast-uri by inspecting package-lock.json or yarn.lock\n2. Run the upgrade command: npm install fast-uri@4.1.3 (or @3.1.6 / @2.4.5 depending on your major version pin)\n3. Re-generate package lockfiles and run npm audit to confirm the security advisory is resolved\n4. Deploy the updated application to staging environments and execute validation test scripts containing nested percent-encoded vectors to ensure functionality remains normal\n\n## References\n\n- [GitHub Security Advisory (GHSA-fph4-wmhf-6fwf)](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD Vulnerability Details - CVE-2026-75899](https://nvd.nist.gov/vuln/detail/CVE-2026-75899)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75899) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T18:33:43.506559Z"} https://vulnerability.circl.lu/sighting/df3b9443-53df-447d-ba4e-6d758c88a49b/export Wed, 02 Sep 2026 18:33:43 +0000 https://vulnerability.circl.lu/sighting/7f77e9d2-dc94-4c6a-aba3-1ef0a4939783/export {"uuid": "7f77e9d2-dc94-4c6a-aba3-1ef0a4939783", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mttf54lll72j", "content": "Node.js\u306efast-uri\u3067\u3001URI\u306e\u30db\u30b9\u30c8\u540d\u304c\u4e8c\u91cd\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u3001\u4fe1\u983c\u3067\u304d\u306a\u3044URI\u3092\u51e6\u7406\u3059\u308b\u969b\u306b\u672c\u6765\u3068\u7570\u306a\u308b\u5b9b\u5148\u306b\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002SSRF\u3084\u30db\u30b9\u30c8\u30dd\u30ea\u30b7\u30fc\u30d0\u30a4\u30d1\u30b9\u306b\u7e4b\u304c\u308b\u6050\u308c\u2026\nCVE-2026-75899 CVSS 7.5 | HIGH", "creation_timestamp": "2026-08-24T13:15:03.967282Z"} {"uuid": "7f77e9d2-dc94-4c6a-aba3-1ef0a4939783", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mttf54lll72j", "content": "Node.js\u306efast-uri\u3067\u3001URI\u306e\u30db\u30b9\u30c8\u540d\u304c\u4e8c\u91cd\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u3001\u4fe1\u983c\u3067\u304d\u306a\u3044URI\u3092\u51e6\u7406\u3059\u308b\u969b\u306b\u672c\u6765\u3068\u7570\u306a\u308b\u5b9b\u5148\u306b\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002SSRF\u3084\u30db\u30b9\u30c8\u30dd\u30ea\u30b7\u30fc\u30d0\u30a4\u30d1\u30b9\u306b\u7e4b\u304c\u308b\u6050\u308c\u2026\nCVE-2026-75899 CVSS 7.5 | HIGH", "creation_timestamp": "2026-08-24T13:15:03.967282Z"} https://vulnerability.circl.lu/sighting/7f77e9d2-dc94-4c6a-aba3-1ef0a4939783/export Mon, 24 Aug 2026 13:15:03 +0000 https://vulnerability.circl.lu/sighting/f9c8b6fd-239f-4af8-99ad-5e58543330ce/export {"uuid": "f9c8b6fd-239f-4af8-99ad-5e58543330ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mtt6ezu55n25", "content": "fast-uri, the URL parser inside Fastify and many Node apps, can resolve a safe-looking address to localhost (CVE-2026-75899).\n\nIt slips past URL allowlist checks, and you may ship it as a hidden dependency.\n\nFix: update to 2.4.5, 3.1.6, or 4.1.3.", "creation_timestamp": "2026-08-24T11:14:13.850815Z"} {"uuid": "f9c8b6fd-239f-4af8-99ad-5e58543330ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mtt6ezu55n25", "content": "fast-uri, the URL parser inside Fastify and many Node apps, can resolve a safe-looking address to localhost (CVE-2026-75899).\n\nIt slips past URL allowlist checks, and you may ship it as a hidden dependency.\n\nFix: update to 2.4.5, 3.1.6, or 4.1.3.", "creation_timestamp": "2026-08-24T11:14:13.850815Z"} https://vulnerability.circl.lu/sighting/f9c8b6fd-239f-4af8-99ad-5e58543330ce/export Mon, 24 Aug 2026 11:14:13 +0000 https://vulnerability.circl.lu/sighting/ff4bcfa0-9621-4ce8-99bc-dd4550051b14/export {"uuid": "ff4bcfa0-9621-4ce8-99bc-dd4550051b14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mtszcefdrc2b", "content": "\ud83d\udea8 High-severity security fix in fast-uri 2.4.5, 3.1.6, and 4.1.3 just released!\n\nPatches CVE-2026-75899. Server-side request forgery via repeated hostname percent-decoding.\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-08-24T09:43:16.616361Z"} {"uuid": "ff4bcfa0-9621-4ce8-99bc-dd4550051b14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mtszcefdrc2b", "content": "\ud83d\udea8 High-severity security fix in fast-uri 2.4.5, 3.1.6, and 4.1.3 just released!\n\nPatches CVE-2026-75899. Server-side request forgery via repeated hostname percent-decoding.\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-08-24T09:43:16.616361Z"} https://vulnerability.circl.lu/sighting/ff4bcfa0-9621-4ce8-99bc-dd4550051b14/export Mon, 24 Aug 2026 09:43:16 +0000