fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

🗓️ 02 Sep 2026 15:43:30Reported by GitHub Advisory DatabaseType

SSRF in fast-uri via malformed IPv6 normalization routing to local or private addresses.

Reporter	Title	Published	Views	Family All 27
Circl	CVE-2026-75975	24 Aug 202610:03	–	circl
CVE	CVE-2026-75975	24 Aug 202609:58	–	cve
Cvelist	CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization	24 Aug 202609:58	–	cvelist
Debian CVE	CVE-2026-75975	24 Aug 202609:58	–	debiancve
EUVD	EUVD-2026-64772	2 Sep 202615:43	–	euvd
NVD	CVE-2026-75975	24 Aug 202610:16	–	nvd
OSV	DEBIAN-CVE-2026-75975	24 Aug 202610:16	–	osv
OSV	GHSA-F65P-4M7J-42XC fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization	2 Sep 202615:43	–	osv
OSV	RHSA-2026:60855 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update	30 Aug 202610:06	–	osv
OSV	RHSA-2026:60856 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update	30 Aug 202610:06	–	osv

Vulners

Node

openjsf fast-uriRange4.0.0–4.1.3npm

openjsf fast-uriRange3.0.0–3.1.6npm

openjsf fast-uriRange2.3.1–2.4.5npm

Source	Link
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-75975
github	www.github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595
github	www.github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f
github	www.github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/fastify/fast-uri/releases/tag/v2.4.5
github	www.github.com/fastify/fast-uri/releases/tag/v3.1.6
github	www.github.com/fastify/fast-uri/releases/tag/v4.1.3
github	www.github.com/advisories/GHSA-f65p-4m7j-42xc

02 Sep 2026 15:43Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00234

SSVC