# CVE-2026-75899: fast-uri server-side request forgery via double percent-decoding

Source: https://junglewise.ai/threats/cve-2026-75899-fast-uri-server-side-request-forgery-via-double-percent-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75899 · Severity: high · CVSS 7.5 · Published 2026-08-24

fast-uri is a Node.js library used to parse and normalize web addresses (URIs). The library decodes encoded hostnames twice during normalization, allowing attackers to bypass security checks designed to prevent server-side request forgery attacks. An attacker can craft a specially encoded URL that passes initial security validation but gets decoded into a malicious destination like an internal server or cloud metadata endpoint, potentially exposing sensitive data or allowing unauthorized access.

Technologies: [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-75899 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75899 being exploited in the wild.

**How severe is CVE-2026-75899?** High severity, with a CVSS score of 7.5, published 24 August 2026.

**Which products and versions are affected?** fast-uri (npm) SEMVER:introduced=2.4.1,fixed=2.4.5.

**Is there a fix for CVE-2026-75899?** Yes. fast-uri (npm): upgrade to 2.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75899 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75899?** Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-uri (npm): upgrade to 2.4.5 or later

  ```sh
  npm install fast-uri@2.4.5
  ```


## Technical details

fast-uri performs URI parsing and authority recomposition in a single operation, inadvertently decoding percent-escaped hostnames twice: once during initial parsing and again when reconstructing the authority component. This double-decoding flaw (CWE-174) combined with SSRF semantics (CWE-918) allows an attacker to craft nested percent-encoded URIs like `http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/` that normalize to `http://localhost/`. The attack requires no authentication or user interaction and operates over the network. Applications performing security checks (SSRF validation, redirect allowlists, or host filtering) before calling normalize() or resolve() are vulnerable because the checked URI differs from the normalized destination. Patches are available in versions 2.4.5, 3.1.6, and 4.1.3; users can implement a temporary workaround by rejecting URIs containing encoded percent signs (%25) in the host component.

## Affected products

- Fastify fast-uri 2.4.1–2.4.4, 3.1.2–3.1.5, 4.0.0–4.1.2

## Identifiers

- CVE-2026-75899
- GHSA-fph4-wmhf-6fwf

## Timeline

- 2026-08-23: disclosed: Published to GitHub Advisory Database
- 2026-08-23: patched: Fixed in fast-uri 2.4.5, 3.1.6, and 4.1.3
- 2026-09-02: advisory: Updated in GitHub Advisory Database

## References

- [https://api.github.com/users/NotAFlightRisk](https://api.github.com/users/NotAFlightRisk)
- [https://github.com/NotAFlightRisk](https://github.com/NotAFlightRisk)
- [https://api.github.com/users/NotAFlightRisk/gists%7B/gist_id%7D](https://api.github.com/users/NotAFlightRisk/gists%7B/gist_id%7D)
- [https://api.github.com/users/NotAFlightRisk/repos](https://api.github.com/users/NotAFlightRisk/repos)
- [https://avatars.githubusercontent.com/u/23277273?v=4](https://avatars.githubusercontent.com/u/23277273?v=4)
- [https://api.github.com/users/NotAFlightRisk/events%7B/privacy%7D](https://api.github.com/users/NotAFlightRisk/events%7B/privacy%7D)

## Related threats

- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri URI scheme spoofing via percent-encoded scheme](https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri host confusion via unchecked WHATWG canonicalization](https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri mailto header injection via percent-encoded field-name desynchronization](https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name)