NPM: fast-uri vulnerable to host confusion via percent-encoded scheme normalization

🗓️ 02 Sep 2026 15:41:53Reported by PatchstackType

Host confusion in NPM fast-uri 2.3.1-2.4.4 via percent-encoded scheme normalization.

Reporter	Title	Published	Views	Family All 349
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	22 Sep 202607:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple issues like double decoding, interpretation conflict and more due to the use of fast-uri (CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172)	7 Sep 202607:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in fast-uri (CVE-2026-75975, CVE-2026-76172)	29 Sep 202618:52	–	ibm
IBM Security Bulletins	Security Bulletin: fast-uri-3.1.5.tgz (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:17	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials	21 Sep 202622:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules	7 Sep 202612:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities	22 Sep 202604:31	–	ibm
IBM Security Bulletins	Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri.	29 Sep 202609:14	–	ibm
Tenable Nessus	AlmaLinux 10 : cockpit-image-builder (ALSA-2026:71543)	29 Sep 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: cockpit-image-builder Multiple Vulnerabilities (crlsa-2026_71543)	1 Oct 202600:00	–	nessus

Vulners

Node

npm fast-uriRange≤>= 2.3.1, 2.4.5

Source	Link
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-76172
github	www.github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862
github	www.github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b
github	www.github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/fastify/fast-uri/releases/tag/v2.4.5
github	www.github.com/fastify/fast-uri/releases/tag/v3.1.6
github	www.github.com/fastify/fast-uri/releases/tag/v4.1.3
github	www.github.com/advisories/GHSA-jqff-g426-hqxp

02 Sep 2026 15:41Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00232

SSVC