fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

🗓️ 02 Sep 2026 15:43:30Reported by GitHub Advisory DatabaseType

SSRF in fast-uri via malformed IPv6 normalization routing to local or private addresses.

Reporter	Title	Published	Views	Family All 353
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	22 Sep 202607:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple issues like double decoding, interpretation conflict and more due to the use of fast-uri (CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172)	7 Sep 202607:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite is vulnerable to multiple vulnerabilities	1 Oct 202609:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in fast-uri (CVE-2026-75975, CVE-2026-76172)	29 Sep 202618:52	–	ibm
IBM Security Bulletins	Security Bulletin: fast-uri-3.1.5.tgz (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:17	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials	21 Sep 202622:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules	7 Sep 202612:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities	22 Sep 202604:31	–	ibm
IBM Security Bulletins	Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri.	29 Sep 202609:14	–	ibm
Tenable Nessus	AlmaLinux 10 : cockpit-image-builder (ALSA-2026:71543)	29 Sep 202600:00	–	nessus

Vulners

Node

openjsf fast-uriRange4.0.0–4.1.3npm

openjsf fast-uriRange3.0.0–3.1.6npm

openjsf fast-uriRange2.3.1–2.4.5npm

Source	Link
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-75975
github	www.github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595
github	www.github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f
github	www.github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/fastify/fast-uri/releases/tag/v2.4.5
github	www.github.com/fastify/fast-uri/releases/tag/v3.1.6
github	www.github.com/fastify/fast-uri/releases/tag/v4.1.3
github	www.github.com/advisories/GHSA-f65p-4m7j-42xc

02 Sep 2026 15:43Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.0022

SSVC