CVE-2026-75931

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a patched version.

• CWE-436

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8Vendor Advisory, Mitigation

Published

Aug 24, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75925Improper neutralization of CRLF sequences in IXON VPN Client…9.6
• CVE-2026-75926Hugo 0.161.0 placed the Node asset pipelines behind the Node…8.6
• CVE-2026-75927The PublishPress Capabilities – User Role Editor, Access Per…7.2
• CVE-2026-75928The Brushfire platform's video content streaming application…5.3
• CVE-2026-7593A security vulnerability has been detected in Sunwood-ai-lab…7.3
• CVE-2026-75930The FundEngine – Donation and Crowdfunding Platform plugin f…4.3
• CVE-2026-75932Jet Admin allows an attacker to create a malicious app and c…8.6
• CVE-2026-75933Jet Admin allows an authenticated attacker to inject JavaScr…7.3
• CVE-2026-75935Uncontrolled memory allocation in the binary Ion stream curs…7.5
• CVE-2026-75936Improper handling of highly compressed data in the GZIP auto…7.5
• CVE-2026-7594A vulnerability was detected in Flux159 mcp-game-asset-gen 0…7.3
• CVE-2026-75940A vulnerability was reported in Lenovo Health Android Applic…9.1