{"id":"CVE-2026-76172","title":"fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)","summary":"A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers (URIs) in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","cwe":["CWE-76","CWE-177"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["migration_toolkit_for_applications 8","multicluster_engine_for_kubernetes","network_observability_operator","openshift_lightspeed","openshift_pipelines","openshift_serverless","ansible_automation_platform 2","build_of_apicurio_registry 3","build_of_podman_desktop","developer_hub","enterprise_linux 10","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","satellite 6","secrets_management_console_for_red_hat_openshift","self_service_automation_portal 2","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","ansible_automation_platform 2.1","ansible_automation_platform 2.2","ansible_automation_platform 2.7","developer_hub 1.9","discovery 2","edge_manager 1.1","edge_manager 1.2","hardened_images","migration_toolkit 1.8","openshift_dev_spaces 3.30","satellite 6.18","satellite 6.19"],"patched":["advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","ansible_automation_platform 2.1","ansible_automation_platform 2.2","ansible_automation_platform 2.7","developer_hub 1.9","discovery 2","edge_manager 1.1","edge_manager 1.2","hardened_images","migration_toolkit 1.8","openshift_dev_spaces 3.30","satellite 6.18","satellite 6.19"],"published":"2026-08-24","updated":"2026-09-21","sourceUpdated":"2026-09-21T11:19:37+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76172.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76172.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-76172"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521798"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76172"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76172"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"},{"url":"https://access.redhat.com/errata/RHSA-2026:67542"},{"url":"https://access.redhat.com/errata/RHSA-2026:67543"},{"url":"https://access.redhat.com/errata/RHSA-2026:65118"},{"url":"https://access.redhat.com/errata/RHSA-2026:65155"},{"url":"https://access.redhat.com/errata/RHSA-2026:67279"},{"url":"https://access.redhat.com/errata/RHSA-2026:69248"},{"url":"https://access.redhat.com/errata/RHSA-2026:61783"},{"url":"https://access.redhat.com/errata/RHSA-2026:68044"},{"url":"https://access.redhat.com/errata/RHSA-2026:68253"},{"url":"https://access.redhat.com/errata/RHSA-2026:68006"},{"url":"https://access.redhat.com/errata/RHSA-2026:68254"},{"url":"https://access.redhat.com/errata/RHSA-2026:60866"},{"url":"https://access.redhat.com/errata/RHSA-2026:60855"},{"url":"https://access.redhat.com/errata/RHSA-2026:60856"},{"url":"https://access.redhat.com/errata/RHSA-2026:68681"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"},{"url":"https://access.redhat.com/errata/RHSA-2026:68762"},{"url":"https://access.redhat.com/errata/RHSA-2026:68756"},{"url":"https://access.redhat.com/errata/RHSA-2026:68766"},{"url":"https://access.redhat.com/errata/RHSA-2026:68765"},{"url":"https://access.redhat.com/errata/RHSA-2026:68748"},{"url":"https://access.redhat.com/errata/RHSA-2026:68750"},{"url":"https://access.redhat.com/errata/RHSA-2026:68747"},{"url":"https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862"},{"url":"https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b"},{"url":"https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.5"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.6"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.3"},{"url":"https://github.com/advisories/GHSA-jqff-g426-hqxp"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00232,"epssPercentile":0.14295,"aliases":["GHSA-jqff-g426-hqxp"],"ecosystem":"npm","ingestedAt":"2026-09-02T15:46:29.310Z","slug":"CVE-2026-76172","body":"## Overview\n\nA flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers (URIs) in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An attacker can exploit this by crafting a malicious URI, causing the parser to misinterpret the host, which can lead to serious security risks. These risks include unauthorized redirection to external websites, server-side request forgery (SSRF) where the application makes unintended requests to internal or external resources, and bypassing security policies.\n\n## Vendor advisories\n\n- **RHSA-2026:67542** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67542)\n- **RHSA-2026:67543** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67543)\n- **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118)\n- **RHSA-2026:65155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65155)\n- **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279)\n- **RHSA-2026:69248** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69248)\n- **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783)\n- **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044)\n- **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253)\n- **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006)\n- **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, Network Observability Operator, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Serverless, … · no fix planned: Red Hat Ansible Automation Platform 2, Secrets Management Console for Red Hat OpenShift, Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76172.json)\n- **RHSA-2026:60866** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60866)\n- **RHSA-2026:60855** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60855)\n- **RHSA-2026:60856** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60856)\n\n**fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects** — rated Important by Red Hat. Released 2026-08-24, updated 2026-09-21.\n\nAffected:\n\n- Migration Toolkit for Applications 8\n- Multicluster Engine for Kubernetes\n- Network Observability Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Podman Desktop\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n- Secrets Management Console for Red Hat OpenShift\n- Self-service automation portal 2\n\nFixed:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Ansible Automation Platform 2.1\n- Red Hat Ansible Automation Platform 2.2\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat Developer Hub 1.9\n- Red Hat Discovery 2\n- Red Hat Edge Manager 1.1\n- Red Hat Edge Manager 1.2\n- Red Hat Hardened Images\n- Red Hat Migration Toolkit 1.8\n- Red Hat OpenShift Dev Spaces 3.30\n- Red Hat Satellite 6.18\n- Red Hat Satellite 6.19\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Secrets Management Console for Red Hat OpenShift\n- Migration Toolkit for Applications 8\n- Multicluster Engine for Kubernetes\n- Network Observability Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Podman Desktop\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n- Self-service automation portal 2\n\nNot affected:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat Developer Hub 1.9\n- Red Hat Discovery 2\n- Red Hat Edge Manager 1.1\n- Red Hat Edge Manager 1.2\n- Red Hat Migration Toolkit 1.8\n- Red Hat OpenShift Dev Spaces 3.30\n- OpenShift Serverless\n\n## Remediation\n\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67542\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67543\nFor more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:65118\n\n## Package advisory (CVE-2026-76172)\n\nAffected packages:\n\n- `fast-uri >= 2.3.1, < 2.4.5`\n- `fast-uri >= 3.0.0, < 3.1.6`\n- `fast-uri >= 4.0.0, < 4.1.3`\n\nPatched in:\n\n- `fast-uri 2.4.5`\n- `fast-uri 3.1.6`\n- `fast-uri 4.1.3`\n\nSource: https://github.com/advisories/GHSA-jqff-g426-hqxp","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}