# CVE-2026-75975: fast-uri server-side request forgery via malformed IPv6 normalization

Source: https://junglewise.ai/threats/cve-2026-75975-fast-uri-server-side-request-forgery-via-malformed-ipv6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75975 · Severity: high · CVSS 7.5 · Published 2026-08-24

fast-uri is a JavaScript library used to parse and normalize URLs in web applications. The library fails to properly validate IPv6 addresses in URLs, silently converting malformed IPv6 syntax into different valid addresses. This allows attackers to craft URLs that bypass security checks and redirect applications to internal or private network addresses, potentially enabling server-side request forgery attacks against internal services, databases, or cloud metadata endpoints.

Technologies: [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-75975 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75975 being exploited in the wild.

**How severe is CVE-2026-75975?** High severity, with a CVSS score of 7.5, published 24 August 2026.

**Which products and versions are affected?** fast-uri (npm) SEMVER:introduced=2.3.1,fixed=2.4.5.

**Is there a fix for CVE-2026-75975?** Yes. fast-uri (npm): upgrade to 2.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75975 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75975?** Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-uri (npm): upgrade to 2.4.5 or later

  ```sh
  npm install fast-uri@2.4.5
  ```


## Technical details

The vulnerability is an improper input validation flaw (CWE-20) in the URL parsing logic that handles RFC 3986 bracketed IPv6 literals. When fast-uri encounters a malformed IPv6 literal with invalid trailing text (e.g., `[::not-valid]` or `[fc00::not-hex]`), it silently truncates the invalid portion and normalizes it to a valid IPv6 address (e.g., `[::]` or `[fc00::]`) without reporting an error. This is an instance of server-side request forgery (CWE-918) when applications trust the normalized host for security decisions. An attacker can exploit this by supplying a crafted IPv6 URL that normalizes to a private address like loopback (::1), causing outbound requests, redirects, or host-policy checks to target unintended internal services. The vulnerability is network-accessible with no authentication or user interaction required. Patches are available in versions 2.4.5, 3.1.6, and 4.1.3, which reject malformed IPv6 literals with a host error instead of silently normalizing them.

## Affected products

- fastify fast-uri 2.3.1 to 2.4.4, 3.0.0 to 3.1.5, 4.0.0 to 4.1.2

## Identifiers

- CVE-2026-75975
- GHSA-f65p-4m7j-42xc

## Timeline

- 2026-08-23: disclosed: Initial disclosure by Matteo Collina
- 2026-08-23: patched: Patches released: v2.4.5, v3.1.6, v4.1.3
- 2026-09-02: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/mcollina](https://api.github.com/users/mcollina)
- [https://github.com/mcollina](https://github.com/mcollina)
- [https://api.github.com/users/mcollina/gists%7B/gist_id%7D](https://api.github.com/users/mcollina/gists%7B/gist_id%7D)
- [https://api.github.com/users/mcollina/repos](https://api.github.com/users/mcollina/repos)
- [https://avatars.githubusercontent.com/u/52195?v=4](https://avatars.githubusercontent.com/u/52195?v=4)
- [https://api.github.com/users/mcollina/events%7B/privacy%7D](https://api.github.com/users/mcollina/events%7B/privacy%7D)

## Related threats

- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri URI scheme spoofing via percent-encoded scheme](https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri host confusion via unchecked WHATWG canonicalization](https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri mailto header injection via percent-encoded field-name desynchronization](https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name)