Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-24T09:40:19 fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CWE-140

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.

This flaw in the `fast-uri` library, used by applications for URI parsing, allows for Server-Side Request Forgery (SSRF) and host-policy bypass. By crafting a doubly percent-encoded hostname in an untrusted HTTP-family URI, an attacker could redirect internal application requests to arbitrary network destinations, potentially bypassing security controls and accessing internal services. This risk is present in Red Hat products that process untrusted URIs using affected versions of `fast-uri`. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Discovery 2 2026-08-31T00:00:00Z RHSA-2026:61783 discovery/discovery-ui-rhel9:1788206196 Red Hat Hardened Images 2026-08-29T00:00:00Z RHSA-2026:60855 grafana13-1-main-13.1.3-0.3.hum1 Red Hat Hardened Images 2026-08-29T00:00:00Z RHSA-2026:60856 grafana13-2-main-13.2.0-0.1.2.hum1 Red Hat Hardened Images 2026-08-29T00:00:00Z RHSA-2026:60866 grafana12-4-main-12.4.9-0.4.hum1 Migration Toolkit for Applications 8 Affected mta/mta-solution-server-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-ui-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/console-mce-rhel9 Network Observability Operator Affected network-observability/network-observability-console-plugin-pf5-rhel9 Network Observability Operator Affected network-observability/network-observability-console-plugin-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-agentic-console-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-console-plugin-419-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-console-plugin-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-hub-ui-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-hub-ui-rhel9 OpenShift Serverless Not affected openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 OpenShift Serverless Not affected openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 OpenShift Serverless Not affected openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 OpenShift Serverless Not affected openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 OpenShift Serverless Not affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 OpenShift Serverless Not affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 OpenShift Serverless Not affected openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 OpenShift Serverless Not affected openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-transform-jsonata-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/console-rhel9 Red Hat AMQ Broker 7 Not affected amq-broker-bin.zip Red Hat AMQ Broker 7 Not affected amq-broker-maven-repository.zip Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/mcp-server-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-tech-preview/mcp-server-rhel9 Red Hat Ansible Automation Platform 2 Not affected automation-gateway Red Hat Ansible Automation Platform 2 Not affected automation-platform-ui Red Hat build of Apicurio Registry 3 Affected apicurio/apicurio-registry-ui-rhel8 Red Hat Build of Podman Desktop Affected rh-podman-desktop.git Red Hat Connectivity Link 1 Not affected rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 Will not fix redhat-datagrid-maven-repository.zip Red Hat Developer Hub Not affected rhdh/red-hat-developer-hub-backstage-plugin-lightspeed Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Red Hat Edge Manager 1 Affected rhem/flightctl-ui-ocp-rhel10 Red Hat Edge Manager 1 Affected rhem/flightctl-ui-ocp-rhel9 Red Hat Edge Manager 1 Affected rhem/flightctl-ui-rhel10 Red Hat Edge Manager 1 Affected rhem/flightctl-ui-rhel9 Red Hat Enterprise Linux 10 Affected cockpit-image-builder Red Hat Enterprise Linux 10 Not affected dotnet8.0 Red Hat Enterprise Linux 10 Not affected grafana Red Hat Enterprise Linux 10 Not affected grafana-pcp Red Hat Enterprise Linux 10 Not affected linux-sgx Red Hat Enterprise Linux 10 Affected rh-podman-desktop Red Hat Enterprise Linux 8 Not affected dotnet8.0 Red Hat Enterprise Linux 9 Not affected dotnet8.0 Red Hat Enterprise Linux 9 Not affected linux-sgx Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Hardened Images Not affected dotnet8.0 Red Hat Hardened Images Not affected jaeger Red Hat Hardened Images Not affected prometheus3.13 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-core-bff-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-operator-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-feature-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/nmstate-console-plugin-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/dashboard-rhel9 Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Quay 3 Affected quay/quay-rhel9 Red Hat Satellite 6 Affected nodejs-compression-webpack-plugin Red Hat Satellite 6 Affected nodejs-mini-css-extract-plugin Red Hat Satellite 6 Affected nodejs-webpack Red Hat Satellite 6 Affected satellite/iop-advisor-frontend-rhel9 Red Hat Satellite 6 Affected satellite/iop-host-inventory-frontend-rhel9 Red Hat Satellite 6 Affected satellite/iop-remediations-rhel9 Red Hat Satellite 6 Affected satellite/iop-vulnerability-frontend-rhel9 Secrets Management Console for Red Hat OpenShift Will not fix external-secrets-management/console-plugin-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/automation-portal Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-75899 https://nvd.nist.gov/vuln/detail/CVE-2026-75899 https://cna.openjsf.org/security-advisories.html https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf