ROOT-APP-NPM-CVE-2026-75899 CVE-2026-75899 in fast-uri - Patched by Root

Root has patched CVE-2026-75899 in the fast-uri package for Root:npm. Multiple fixed versions available...

CVE-2026-75899 vulnerabilities

Vulnerabilities for packages: tileserver-gl, yaml-language-server, prism, vitess, jupyter-base-notebook, opensearch-dashboards, argo-workflows...

CVE-2026-75899 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, argo-workflows, arangodb, keep, unleash-fips, langfuse, tileserver-gl, keep-fips, yaml-language-server, prism, gitlab-rails-ce-fips, tensorflow-gpu-jupyter, kibana, langfuse-fips, vitess, wazuh-dashboard-fips, opensearch-dashboards,...

@diviops/mcp-server (>=1.5.40, <=1.5.43), @diviskit/mcp-server (>=1.6.0, <=1.7.0) +20 more potentially affected by CVE-2026-75899 via fast-uri (>=3.1.2, <=3.1.5)

fast-uri NPM version =3.1.2, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =1.25.0, =1.28.5 and more Source cves: CVE-2026-75899 Source advisory: OSV:GHSA-FPH4-WMHF-6FWF...

@diviops/mcp-server (>=1.5.40, <=1.5.43), @diviskit/mcp-server (>=1.6.0, <=1.7.0) +20 more potentially affected by CVE-2026-75899 via fast-uri (>=3.1.2, <=3.1.5)

fast-uri NPM version =3.1.2, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =1.25.0, =1.28.5 and more Source cves: CVE-2026-75899 Source advisory: SNYK:JS-FASTURI-19256873...

DEBIAN-CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

creationtimestamp| type| source ---|---|--- 2026-08-24 09:43:16+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mtszcefdrc2b 2026-08-24 11:14:13+00:00| seen| https://bsky.app/profile/suriq.io/post/3mtt6ezu55n25 2026-08-24 13:15:03+00:00| seen|...

@diviops/mcp-server (>=1.5.40, <=1.5.43), @diviskit/mcp-server (>=1.6.0, <=1.7.0) +20 more potentially affected by CVE-2026-75899 via fast-uri (>=3.1.2, <=3.1.5)

fast-uri NPM version =3.1.2, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =1.25.0, =1.28.5 and more Source cves: CVE-2026-75899 Source advisory: MEND:CVE-2026-75899...