Is CVE-2026-75931 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75931 being exploited in the wild.

How severe is CVE-2026-75931?

High severity, with a CVSS score of 7.5, published 24 August 2026.

Which products and versions are affected?

fast-uri (npm) SEMVER:introduced=2.4.2,fixed=2.4.5.

Is there a fix for CVE-2026-75931?

Yes. fast-uri (npm): upgrade to 2.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75931 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-75931?

Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75931: Fastify fast-uri host confusion via skipped IDN canonicalization

CVE-2026-75931 · Severity: high · CVSS 7.5 · Published 2026-08-24

fast-uri is a URL parsing and resolution library used by web applications to process and normalize Internationalized Domain Names (IDN). When resolving scheme-relative URLs (those starting with //), the library fails to properly convert non-ASCII hostnames to their canonical ASCII form. An attacker can craft a malicious URL that causes an application to make a security decision (such as access control or routing) based on one hostname but then actually connect to a different one, potentially bypassing allowlist checks or reaching unintended backend services.

Technologies: fast-uri (npm). Vendors: npm.

Quick answers

Is CVE-2026-75931 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75931 being exploited in the wild.
How severe is CVE-2026-75931?: High severity, with a CVSS score of 7.5, published 24 August 2026.
Which products and versions are affected?: fast-uri (npm) SEMVER:introduced=2.4.2,fixed=2.4.5.
Is there a fix for CVE-2026-75931?: Yes. fast-uri (npm): upgrade to 2.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75931 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-75931?: Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-uri (npm): upgrade to 2.4.5 or later
```
npm install fast-uri@2.4.5
```

Technical details

The vulnerability exists in the resolve() function of fast-uri, which handles URI resolution per RFC 3986. When a scheme-relative reference (//hostname/) is resolved against a base URI with an explicit scheme, the library correctly inherits the scheme but fails to canonicalize the resulting hostname via IDN processing. This means a non-ASCII hostname remains in its original form in the returned URI string, but when that URI is reparsed by another component, the IDN canonicalization is applied, resulting in a different ASCII hostname. The root cause is incomplete fix of CVE-2026-13676, which only applied IDN canonicalization to URIs with explicit schemes. An attacker can exploit this to resolve a reference against a base, check one hostname (the non-ASCII form), and reach a different canonical hostname (the ASCII form) on re-parsing. The fix (in versions 2.4.5, 3.1.6, 4.1.3) applies canonicalization once the effective scheme is known and fails closed if a non-ASCII hostname cannot be converted, preventing the mismatch.

Affected products

Fastify fast-uri >=2.4.2,<2.4.5; >=3.1.3,<3.1.6; >=4.0.1,<4.1.3

Identifiers

CVE-2026-75931
GHSA-5jgf-p345-68v8

Timeline

2026-08-23: disclosed
2026-09-02: patched: Patches released: fast-uri 2.4.5, 3.1.6, and 4.1.3
2026-09-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.