Improper Validation of Syntactic Correctness of Input Affecting fast-uri package, versions >=2.3.1 <2.4.5>=3.0.0 <3.1.6>=4.0.0 <4.1.3
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-FASTURI-19256871
- published25 Aug 2026
- disclosed24 Aug 2026
- creditUnknown
Introduced: 24 Aug 2026
NewCVE-2026-75975 (opens in a new tab)How to fix?
Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.
Overview
fast-uri is a Dependency-free RFC 3986 URI toolbox
Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the normalizeIPv6() and parseWithStatus() host-processing paths in lib/utils.js and index.js. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as http://[::not-valid]/private before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.
Workarounds
- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to
fast-uri; this prevents malformed IPv6 text from being normalized into a different valid local or private address. - Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.