THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-f65p-4m7j-42xc (high) — fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

[GHSA] GHSA-f65p-4m7j-42xc (high) — fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

medgithub_advisoriesPublished 2026-09-02

GHSA-f65p-4m7j-42xc Severity: high CVE: CVE-2026-75975

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

### Impact

`fast-uri` does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, `normalize('http

Indicators of compromise

CVE-2026-75975cve

Original source: https://github.com/advisories/GHSA-f65p-4m7j-42xc