{"vulnerability": "cve-2026-76172", "sightings": [{"uuid": "67ba723c-9023-41cd-875c-f9c523c18c5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76172", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mtt2uomns22b", "content": "\ud83d\udea8 High-severity security fix in fast-uri 2.4.5, 3.1.6, and 4.1.3 just released!\n\nPatches CVE-2026-76172. Host confusion via percent-encoded scheme normalization.\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-08-24T10:11:24.990809Z"}, {"uuid": "88a8129e-d75e-4b5e-9931-54970f4477f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76172", "type": "seen", "source": "https://gist.github.com/alon710/af575107e879f298d568b88dd8bac4cb", "content": "# CVE-2026-76172: CVE-2026-76172: Parser Differential and Host Confusion in fast-uri\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76172\n\n## Summary\nA critical parser differential and host confusion vulnerability (CVE-2026-76172) exists in fast-uri, a dependency-free URI validation and normalization library for Node.js. This vulnerability stems from improper validation of the URI scheme component after decoding percent-encoded characters using the legacy global unescape() function. This allows structural characters such as path delimiters and control characters to be written raw into the output stream during serialization, causing host confusion, Server-Side Request Forgery (SSRF), or HTTP response splitting downstream.\n\n## TL;DR\nfast-uri parses percent-encoded schemes with lenient decoding and no validation, resulting in structure mutation, host confusion, and SSRF upon serialization.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-177\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 7.5\n- **EPSS Score**: 0.00247 (Percentile: 15.89%)\n- **Impact**: Host Confusion / SSRF / HTTP Response Splitting\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-uri NPM package (versions 2.3.1 to 2.4.4, 3.0.0 to 3.1.5, and 4.0.0 to 4.1.2)\n- Fastify-dependent security gateways and reverse proxies utilizing fast-uri for input resolution and routing validation\n- **fast-uri**: >= 2.3.1 < 2.4.5 (Fixed in: `2.4.5`)\n- **fast-uri**: >= 3.0.0 < 3.1.6 (Fixed in: `3.1.6`)\n- **fast-uri**: >= 4.0.0 < 4.1.3 (Fixed in: `4.1.3`)\n\n## Mitigation\n\n- Upgrade fast-uri dependency to patched versions immediately.\n- Sanitize input URIs to reject percent-encoded sequences in the scheme component before parsing.\n- Align parser implementations across upstream validation layers and downstream HTTP clients to eliminate parser differentials.\n\n**Remediation Steps:**\n1. Audit the project dependency tree to locate instances of fast-uri using 'npm ls fast-uri' or 'yarn why fast-uri'.\n2. Execute the update command 'npm update fast-uri' or forcefully resolve fast-uri to safe versions.\n3. Verify that the lockfile reflects versions 2.4.5, 3.1.6, 4.1.3, or higher.\n4. Implement a central input validation regex for all user-controlled URLs to ensure the scheme strictly contains allowed alphanumeric characters prior to processing.\n\n## References\n\n- [GitHub Security Advisory GHSA-jqff-g426-hqxp](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD - CVE-2026-76172](https://nvd.nist.gov/vuln/detail/CVE-2026-76172)\n- [CVE.org - CVE-2026-76172](https://www.cve.org/CVERecord?id=CVE-2026-76172)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76172) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T19:33:12.843299Z"}]}