ROOT-APP-NPM-CVE-2026-75975 CVE-2026-75975 in fast-uri - Patched by Root

Root has patched CVE-2026-75975 in the fast-uri package for Root:npm. Multiple fixed versions available...

CVE-2026-75975 vulnerabilities

Vulnerabilities for packages: vitess, yaml-language-server, prism, opensearch-dashboards, argo-workflows, tileserver-gl...

CVE-2026-75975 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, unleash, nextcloud-server, tensorflow-gpu-jupyter, gitlab-rails-ce-fips, argo-workflows, unleash-proxy, tileserver-gl-fips, gitlab-rails-ce, kibana, vitess, opensearch-dashboards-fips, arangodb,...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +24 more potentially affected by CVE-2026-75975 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-75975 Source advisory: OSV:GHSA-F65P-4M7J-42XC...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +24 more potentially affected by CVE-2026-75975 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-75975 Source advisory: SNYK:JS-FASTURI-19256871...

DEBIAN-CVE-2026-75975

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...

CVE-2026-75975

creationtimestamp| type| source ---|---|--- 2026-08-24 10:03:28+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mtt2ghwjcc2b 2026-09-02 17:33:14+00:00| seen| https://gist.github.com/alon710/4dc17918da62d2577fc435c04c7ff596...