# CVE-2026-76172: fast-uri host confusion via percent-encoded scheme normalization

Source: https://junglewise.ai/threats/cve-2026-76172-fast-uri-host-confusion-via-percent-encoded-scheme-normalization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76172 · Severity: high · CVSS 7.5 · Published 2026-08-24

fast-uri is a JavaScript library used by Node.js applications to parse and normalize URIs. A flaw in how it processes percent-encoded characters in the URI scheme component allows attackers to craft URLs that trick the library into changing which host is associated with the URL after normalization or resolution. Applications that use this library to validate URLs before redirects or API calls may be redirected to attacker-controlled domains, or have malicious line breaks injected into HTTP response headers.

Technologies: [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-76172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76172 being exploited in the wild.

**How severe is CVE-2026-76172?** High severity, with a CVSS score of 7.5, published 24 August 2026.

**Which products and versions are affected?** fast-uri (npm) SEMVER:introduced=2.3.1,fixed=2.4.5.

**Is there a fix for CVE-2026-76172?** Yes. fast-uri (npm): upgrade to 2.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76172 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76172?** Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-uri (npm): upgrade to 2.4.5 or later

  ```sh
  npm install fast-uri@2.4.5
  ```


## Technical details

The vulnerability is a URL encoding normalization bypass (CWE-177). fast-uri decodes percent-encoded characters (e.g. %2f, %0d%0a) in the URI scheme using the legacy unescape() function, then serializes them back as raw characters without re-escaping or validating against RFC 3986 scheme grammar. An attacker can craft URIs like %2f%2fevil.example:/pwn that initially parse with no authority, but after normalize() or resolve() emit //evil.example:/pwn, which reparses with host evil.example. Schemes containing %0d%0a (CR LF) reach the output as raw control characters, enabling header injection in HTTP responses. Attack preconditions: the application must normalize/resolve untrusted URLs before redirect checks, host allowlists, or outbound requests, especially if it treats missing authority as same-origin. Patches are available: upgrade to fast-uri ≥ 4.1.3, ≥ 3.1.6 (v3 line), or ≥ 2.4.5 (v2 line).

## Affected products

- Fastify fast-uri >=2.3.1, <2.4.5; >=3.0.0, <3.1.6; >=4.0.0, <4.1.3

## Identifiers

- CVE-2026-76172
- GHSA-jqff-g426-hqxp

## Timeline

- 2026-08-23: disclosed: Vulnerability disclosed to GitHub Advisory Database
- 2026-09-02: advisory: GHSA-jqff-g426-hqxp and CVE-2026-76172 published
- 2026-09-02: patched: Patches released: v2.4.5, v3.1.6, v4.1.3

## References

- [https://api.github.com/users/YashvantHange](https://api.github.com/users/YashvantHange)
- [https://github.com/YashvantHange](https://github.com/YashvantHange)
- [https://api.github.com/users/YashvantHange/gists%7B/gist_id%7D](https://api.github.com/users/YashvantHange/gists%7B/gist_id%7D)
- [https://api.github.com/users/YashvantHange/repos](https://api.github.com/users/YashvantHange/repos)
- [https://avatars.githubusercontent.com/u/97538055?v=4](https://avatars.githubusercontent.com/u/97538055?v=4)
- [https://api.github.com/users/YashvantHange/events%7B/privacy%7D](https://api.github.com/users/YashvantHange/events%7B/privacy%7D)

## Related threats

- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri URI scheme spoofing via percent-encoded scheme](https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri host confusion via unchecked WHATWG canonicalization](https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri mailto header injection via percent-encoded field-name desynchronization](https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name)