{"id":"CVE-2026-75899","title":"fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)","summary":"A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","cwe":["CWE-140","CWE-174","CWE-918"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["migration_toolkit_for_applications 8","multicluster_engine_for_kubernetes","network_observability_operator","openshift_lightspeed","openshift_pipelines","openshift_serverless","ansible_automation_platform 2","build_of_podman_desktop","data_grid 8","developer_hub","enterprise_linux 10","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","satellite 6","secrets_management_console_for_red_hat_openshift","self_service_automation_portal 2","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","ansible_automation_platform 2.1","ansible_automation_platform 2.2","ansible_automation_platform 2.7","developer_hub 1.9","discovery 2","edge_manager 1.1","edge_manager 1.2","hardened_images","migration_toolkit 1.8","openshift_dev_spaces 3.30","satellite 6.18","satellite 6.19"],"patched":["advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","ansible_automation_platform 2.1","ansible_automation_platform 2.2","ansible_automation_platform 2.7","developer_hub 1.9","discovery 2","edge_manager 1.1","edge_manager 1.2","hardened_images","migration_toolkit 1.8","openshift_dev_spaces 3.30","satellite 6.18","satellite 6.19"],"published":"2026-08-24","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:28:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75899.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75899.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-75899"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521778"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75899"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75899"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"},{"url":"https://access.redhat.com/errata/RHSA-2026:67542"},{"url":"https://access.redhat.com/errata/RHSA-2026:67543"},{"url":"https://access.redhat.com/errata/RHSA-2026:65118"},{"url":"https://access.redhat.com/errata/RHSA-2026:65155"},{"url":"https://access.redhat.com/errata/RHSA-2026:67279"},{"url":"https://access.redhat.com/errata/RHSA-2026:69248"},{"url":"https://access.redhat.com/errata/RHSA-2026:61783"},{"url":"https://access.redhat.com/errata/RHSA-2026:68044"},{"url":"https://access.redhat.com/errata/RHSA-2026:68253"},{"url":"https://access.redhat.com/errata/RHSA-2026:68006"},{"url":"https://access.redhat.com/errata/RHSA-2026:68254"},{"url":"https://access.redhat.com/errata/RHSA-2026:60866"},{"url":"https://access.redhat.com/errata/RHSA-2026:60855"},{"url":"https://access.redhat.com/errata/RHSA-2026:60856"},{"url":"https://access.redhat.com/errata/RHSA-2026:68681"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"},{"url":"https://access.redhat.com/errata/RHSA-2026:68762"},{"url":"https://access.redhat.com/errata/RHSA-2026:68756"},{"url":"https://access.redhat.com/errata/RHSA-2026:68766"},{"url":"https://access.redhat.com/errata/RHSA-2026:68748"},{"url":"https://access.redhat.com/errata/RHSA-2026:68750"},{"url":"https://access.redhat.com/errata/RHSA-2026:68747"},{"url":"https://access.redhat.com/errata/RHSA-2026:68755"},{"url":"https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f"},{"url":"https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304"},{"url":"https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.5"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.6"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.3"},{"url":"https://github.com/advisories/GHSA-fph4-wmhf-6fwf"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.0022,"epssPercentile":0.12705,"aliases":["GHSA-fph4-wmhf-6fwf"],"ecosystem":"npm","ingestedAt":"2026-09-02T15:46:29.268Z","slug":"CVE-2026-75899","body":"## Overview\n\nA flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.\n\n## Vendor advisories\n\n- **RHSA-2026:67542** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67542)\n- **RHSA-2026:67543** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67543)\n- **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118)\n- **RHSA-2026:65155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65155)\n- **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279)\n- **RHSA-2026:69248** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69248)\n- **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783)\n- **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044)\n- **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253)\n- **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006)\n- **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, Network Observability Operator, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Serverless, … · no fix planned: Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, Red Hat Data Grid 8, Secrets Management Console for Red Hat OpenShift, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75899.json)\n- **RHSA-2026:60866** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60866)\n- **RHSA-2026:60855** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60855)\n- **RHSA-2026:60856** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60856)\n\n**fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding** — rated Important by Red Hat. Released 2026-08-24, updated 2026-09-21.\n\nAffected:\n\n- Migration Toolkit for Applications 8\n- Multicluster Engine for Kubernetes\n- Network Observability Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat Ansible Automation Platform 2\n- Red Hat Build of Podman Desktop\n- Red Hat Data Grid 8\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n- Secrets Management Console for Red Hat OpenShift\n- Self-service automation portal 2\n\nFixed:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Ansible Automation Platform 2.1\n- Red Hat Ansible Automation Platform 2.2\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat Developer Hub 1.9\n- Red Hat Discovery 2\n- Red Hat Edge Manager 1.1\n- Red Hat Edge Manager 1.2\n- Red Hat Hardened Images\n- Red Hat Migration Toolkit 1.8\n- Red Hat OpenShift Dev Spaces 3.30\n- Red Hat Satellite 6.18\n- Red Hat Satellite 6.19\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Ansible Automation Platform 2\n- Red Hat Data Grid 8\n- Secrets Management Console for Red Hat OpenShift\n- Migration Toolkit for Applications 8\n- Multicluster Engine for Kubernetes\n- Network Observability Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat Build of Podman Desktop\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n- Self-service automation portal 2\n\nNot affected:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat Developer Hub 1.9\n- Red Hat Discovery 2\n- Red Hat Edge Manager 1.1\n- Red Hat Edge Manager 1.2\n- Red Hat Migration Toolkit 1.8\n- Red Hat OpenShift Dev Spaces 3.30\n- Cost Management On Premise\n\n## Remediation\n\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67542\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67543\nFor more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:65118\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-75899)\n\nAffected packages:\n\n- `fast-uri >= 2.4.1, < 2.4.5`\n- `fast-uri >= 3.1.2, < 3.1.6`\n- `fast-uri >= 4.0.0, < 4.1.3`\n\nPatched in:\n\n- `fast-uri 2.4.5`\n- `fast-uri 3.1.6`\n- `fast-uri 4.1.3`\n\nSource: https://github.com/advisories/GHSA-fph4-wmhf-6fwf","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}