CVE-2026-76172

{"id": "CVE-2026-76172", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76172", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T14:29:20.006884Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "affectedData": [{"vendor": "fast-uri", "product": "fast-uri", "versions": [{"status": "affected", "version": "2.3.1", "lessThan": "2.4.5", "versionType": "semver"}, {"status": "unaffected", "version": "2.4.5", "versionType": "semver"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.1.6", "versionType": "semver"}, {"status": "unaffected", "version": "3.1.6", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.3", "versionType": "semver"}, {"status": "unaffected", "version": "4.1.3", "versionType": "semver"}], "packageURL": "pkg:npm/fast-uri", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T11:16:40.723", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-177"}]}], "descriptions": [{"lang": "en", "value": "fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version."}, {"lang": "es", "value": "fast-uri es un analizador de URI para Node.js. Durante el an\u00e1lisis, ejecuta un paso de decodificaci\u00f3n heredado sobre el componente del esquema y nunca vuelve a escapar el resultado, y la serializaci\u00f3n escribe el esquema de vuelta textualmente, a diferencia del componente de host que s\u00ed se vuelve a escapar. Como resultado, una entrada cuyo esquema contiene barras codificadas por porcentaje se analiza como un esquema sin autoridad, por lo que el host analizado y el error son ambos indefinidos; sin embargo, resolver o normalizar esa misma entrada emite una referencia de ruta de red cuya autoridad es elegida por el atacante y se vuelve a analizar a ese host. Una aplicaci\u00f3n que permite en el host analizado, o trata una referencia sin autoridad como segura para resolver contra su base, obtiene lo contrario de lo que verific\u00f3, lo que resulta en una redirecci\u00f3n fuera del sitio, falsificaci\u00f3n de petici\u00f3n del lado del servidor, o una omisi\u00f3n de pol\u00edtica de direcciones. El decodificador heredado tambi\u00e9n expande formas de escape no est\u00e1ndar, ampliando el problema m\u00e1s all\u00e1 de los filtros ascendentes, y los caracteres de control en el esquema pueden llegar a la salida como retorno de carro y salto de l\u00ednea sin procesar. Las versiones afectadas son la 2.3.1 hasta, pero sin incluir, la 2.4.5; la 3.0.0 hasta, pero sin incluir, la 3.1.6; y la 4.0.0 hasta, pero sin incluir, la 4.1.3. El problema est\u00e1 solucionado en las versiones 2.4.5, 3.1.6 y 4.1.3, las cuales rechazan un esquema que no es v\u00e1lido despu\u00e9s de la decodificaci\u00f3n. Los usuarios deben actualizar a una versi\u00f3n parcheada."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3B52B356-9E41-4817-B8A5-C5A5ED7FEDC0", "versionEndExcluding": "2.4.5", "versionStartIncluding": "2.3.1"}, {"criteria": "cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "1AC6ED82-63FA-4FF2-BB90-48BBBB9A0653", "versionEndExcluding": "3.1.6", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E5821EBB-01F8-44C6-8EFF-BA388AB307D5", "versionEndExcluding": "4.1.3", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}