ROOT-APP-NPM-CVE-2026-76172 CVE-2026-76172 in fast-uri - Patched by Root

Root has patched CVE-2026-76172 in the fast-uri package for Root:npm. Multiple fixed versions available...

CVE-2026-76172 vulnerabilities

Vulnerabilities for packages: argo-workflows, yaml-language-server, opensearch-dashboards, prism, tileserver-gl, vitess...

CVE-2026-76172 vulnerabilities

Vulnerabilities for packages: arangodb, langfuse, langfuse-fips, gitlab-rails-ce-fips, kibana, argo-workflows, unleash, opensearch-dashboards, unleash-fips, nextcloud-server, vitess, gitlab-rails-ce, wazuh-dashboard-fips, wazuh-dashboard, yaml-language-server, tileserver-gl-fips,...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @crashtest-ai/cli (>=0.1.0, <=0.1.1) +27 more potentially affected by CVE-2026-76172 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =0.1.0, =0.1.0, =0.1.0, =1.5.40, =1.4.2, =1.2.0, =1.4.18, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =0.1.6, =0.2.5 and more Source cves: CVE-2026-76172 Source advisory: OSV:GHSA-JQFF-G426-HQXP...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @crashtest-ai/cli (>=0.1.0, <=0.1.1) +27 more potentially affected by CVE-2026-76172 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =0.1.0, =0.1.0, =0.1.0, =1.5.40, =1.4.2, =1.2.0, =1.4.18, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =0.1.6, =0.2.5 and more Source cves: CVE-2026-76172 Source advisory: SNYK:JS-FASTURI-19256869...

DEBIAN-CVE-2026-76172

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

CVE-2026-76172

creationtimestamp| type| source ---|---|--- 2026-08-24 10:11:24+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mtt2uomns22b 2026-09-02 19:33:12+00:00| seen| https://gist.github.com/alon710/af575107e879f298d568b88dd8bac4cb...