Is CVE-2026-76172 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76172 being exploited in the wild.

How severe is CVE-2026-76172?

High severity, with a CVSS score of 7.5, published 24 August 2026.

Which products and versions are affected?

fast-uri (npm) SEMVER:introduced=2.3.1,fixed=2.4.5.

Is there a fix for CVE-2026-76172?

Yes. fast-uri (npm): upgrade to 2.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76172 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-76172?

Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76172: fast-uri host confusion via percent-encoded scheme normalization

CVE-2026-76172 · Severity: high · CVSS 7.5 · Published 2026-08-24

fast-uri is a JavaScript library used by Node.js applications to parse and normalize URIs. A flaw in how it processes percent-encoded characters in the URI scheme component allows attackers to craft URLs that trick the library into changing which host is associated with the URL after normalization or resolution. Applications that use this library to validate URLs before redirects or API calls may be redirected to attacker-controlled domains, or have malicious line breaks injected into HTTP response headers.

Technologies: fast-uri (npm). Vendors: npm.

Quick answers

Is CVE-2026-76172 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76172 being exploited in the wild.
How severe is CVE-2026-76172?: High severity, with a CVSS score of 7.5, published 24 August 2026.
Which products and versions are affected?: fast-uri (npm) SEMVER:introduced=2.3.1,fixed=2.4.5.
Is there a fix for CVE-2026-76172?: Yes. fast-uri (npm): upgrade to 2.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76172 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-76172?: Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-uri (npm): upgrade to 2.4.5 or later
```
npm install fast-uri@2.4.5
```

Technical details

The vulnerability is a URL encoding normalization bypass (CWE-177). fast-uri decodes percent-encoded characters (e.g. %2f, %0d%0a) in the URI scheme using the legacy unescape() function, then serializes them back as raw characters without re-escaping or validating against RFC 3986 scheme grammar. An attacker can craft URIs like %2f%2fevil.example:/pwn that initially parse with no authority, but after normalize() or resolve() emit //evil.example:/pwn, which reparses with host evil.example. Schemes containing %0d%0a (CR LF) reach the output as raw control characters, enabling header injection in HTTP responses. Attack preconditions: the application must normalize/resolve untrusted URLs before redirect checks, host allowlists, or outbound requests, especially if it treats missing authority as same-origin. Patches are available: upgrade to fast-uri ≥ 4.1.3, ≥ 3.1.6 (v3 line), or ≥ 2.4.5 (v2 line).

Affected products

Fastify fast-uri >=2.3.1, <2.4.5; >=3.0.0, <3.1.6; >=4.0.0, <4.1.3

Identifiers

CVE-2026-76172
GHSA-jqff-g426-hqxp

Timeline

2026-08-23: disclosed: Vulnerability disclosed to GitHub Advisory Database
2026-09-02: advisory: GHSA-jqff-g426-hqxp and CVE-2026-76172 published
2026-09-02: patched: Patches released: v2.4.5, v3.1.6, v4.1.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.